Windows Event ID 5140 – Microsoft-Windows-Security-Auditing: Network Share Object Accessed

Start by examining the specific details of Event ID 5140 to understand the access pattern and identify potential security concerns.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 5140 in the Event IDs field and click OK
5. Double-click on a 5140 event to view detailed information including:
   • Subject: User account that accessed the share
   • Object: Share name and path accessed
   • Process Information: Process ID and name
   • Network Information: Source address and port
   • Access Request Information: Permissions requested
6. Pay special attention to the Source Address field to identify the originating system
7. Check the Access Mask value to understand what type of access was requested

Use PowerShell to query and analyze Event ID 5140 patterns across time periods to identify trends and anomalies.

1. Open PowerShell as Administrator
2. Query recent 5140 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140} -MaxEvents 100 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Extract specific event details for analysis:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140} -MaxEvents 500
   $Events | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           ObjectName = ($EventData | Where-Object {$_.Name -eq 'ObjectName'}).'#text'
           IpAddress = ($EventData | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
           AccessMask = ($EventData | Where-Object {$_.Name -eq 'AccessMask'}).'#text'
       }
   } | Format-Table -AutoSize

4. Identify top accessing users:

   $Events | Group-Object {($_.ToXml() | Select-Xml -XPath "//Data[@Name='SubjectUserName']").Node.InnerText} | Sort-Object Count -Descending | Select-Object Name, Count

5. Find access attempts from external IP addresses:

   $Events | Where-Object {($_.ToXml() | Select-Xml -XPath "//Data[@Name='IpAddress']").Node.InnerText -notlike '192.168.*' -and ($_.ToXml() | Select-Xml -XPath "//Data[@Name='IpAddress']").Node.InnerText -ne '-'}

Fine-tune Object Access auditing to control Event ID 5140 generation and reduce noise while maintaining security visibility.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Object Access
3. Double-click Audit File Share policy
4. Configure the policy based on your monitoring requirements:
   • Check Success to log successful share access
   • Check Failure to log failed access attempts
   • Click OK to apply changes
5. Verify current audit settings using PowerShell:

   auditpol /get /subcategory:"File Share"

6. For more granular control, configure specific shares for auditing:

   # Enable auditing on a specific share
   $SharePath = "C:\SharedData"
   $ACL = Get-Acl $SharePath
   $AccessRule = New-Object System.Security.AccessControl.FileSystemAuditRule("Everyone", "FullControl", "ContainerInherit,ObjectInherit", "None", "Success,Failure")
   $ACL.SetAuditRule($AccessRule)
   Set-Acl $SharePath $ACL

7. Apply Group Policy updates:

   gpupdate /force

Set up automated monitoring for Event ID 5140 to detect suspicious access patterns and potential security incidents in real-time.

1. Create a PowerShell script for continuous monitoring:

   # Save as Monitor-ShareAccess.ps1
   param(
       [int]$MonitoringIntervalMinutes = 5,
       [string]$AlertThreshold = 50
   )
   
   while ($true) {
       $StartTime = (Get-Date).AddMinutes(-$MonitoringIntervalMinutes)
       $Events = Get-WinEvent -FilterHashtable @{
           LogName='Security'
           Id=5140
           StartTime=$StartTime
       } -ErrorAction SilentlyContinue
       
       if ($Events.Count -gt $AlertThreshold) {
           $AlertMessage = "High share access activity detected: $($Events.Count) events in last $MonitoringIntervalMinutes minutes"
           Write-EventLog -LogName Application -Source "ShareMonitor" -EventId 1001 -EntryType Warning -Message $AlertMessage
           # Add email notification or SIEM integration here
       }
       
       Start-Sleep -Seconds ($MonitoringIntervalMinutes * 60)
   }

2. Register the script as a Windows service or scheduled task:

   # Create scheduled task
   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-ShareAccess.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   Register-ScheduledTask -TaskName "ShareAccessMonitor" -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest

3. Configure Windows Event Forwarding for centralized logging:

   # On collector server
   wecutil qc /q
   wecutil cs subscription.xml

4. Create subscription XML file for Event 5140 collection:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>ShareAccessEvents</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Forward Event ID 5140 from domain computers</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <ConfigurationMode>Normal</ConfigurationMode>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[(EventID=5140)]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

Perform comprehensive forensic analysis by correlating Event ID 5140 with related security events to build complete attack timelines and identify security incidents.

1. Identify related events for correlation analysis:

   # Get logon events correlated with share access
   $ShareEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140} -MaxEvents 1000
   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625} -MaxEvents 1000
   
   # Correlate by LogonId
   $CorrelatedEvents = foreach ($ShareEvent in $ShareEvents) {
       $ShareXML = [xml]$ShareEvent.ToXml()
       $LogonId = ($ShareXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectLogonId'}).'#text'
       
       $RelatedLogon = $LogonEvents | Where-Object {
           $LogonXML = [xml]$_.ToXml()
           ($LogonXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetLogonId'}).'#text' -eq $LogonId
       } | Select-Object -First 1
       
       if ($RelatedLogon) {
           [PSCustomObject]@{
               ShareAccessTime = $ShareEvent.TimeCreated
               LogonTime = $RelatedLogon.TimeCreated
               LogonId = $LogonId
               SharePath = ($ShareXML.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'}).'#text'
               SourceIP = ($ShareXML.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
           }
       }
   }

2. Analyze access patterns for anomaly detection:

   # Detect unusual access times
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140; StartTime=(Get-Date).AddDays(-30)}
   $AccessTimes = $Events | ForEach-Object {
       [PSCustomObject]@{
           Hour = $_.TimeCreated.Hour
           DayOfWeek = $_.TimeCreated.DayOfWeek
           User = ($_.ToXml() | Select-Xml -XPath "//Data[@Name='SubjectUserName']").Node.InnerText
       }
   }
   
   # Find access outside business hours
   $AfterHoursAccess = $AccessTimes | Where-Object {$_.Hour -lt 8 -or $_.Hour -gt 18 -or $_.DayOfWeek -in @('Saturday','Sunday')}
   $AfterHoursAccess | Group-Object User | Sort-Object Count -Descending

3. Export forensic data for external analysis:

   # Export to CSV for analysis tools
   $ForensicData = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140; StartTime=(Get-Date).AddDays(-7)} | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           EventId = $_.Id
           SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           SubjectDomainName = ($EventData | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
           ObjectName = ($EventData | Where-Object {$_.Name -eq 'ObjectName'}).'#text'
           IpAddress = ($EventData | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
           IpPort = ($EventData | Where-Object {$_.Name -eq 'IpPort'}).'#text'
           AccessMask = ($EventData | Where-Object {$_.Name -eq 'AccessMask'}).'#text'
       }
   }
   $ForensicData | Export-Csv -Path "C:\Forensics\ShareAccess_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation

4. Create timeline analysis for incident response:

   # Generate timeline for specific user or IP
   $TargetUser = "DOMAIN\username"
   $Timeline = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,5140; StartTime=(Get-Date).AddDays(-1)} | 
       Where-Object {$_.Message -like "*$TargetUser*"} | 
       Sort-Object TimeCreated | 
       Select-Object TimeCreated, Id, LevelDisplayName, @{Name='EventType';Expression={
           switch ($_.Id) {
               4624 {'Successful Logon'}
               4625 {'Failed Logon'}
               5140 {'Share Access'}
           }
       }}, Message
   $Timeline | Format-Table -Wrap