Windows Event ID 5143 – Microsoft-Windows-Security-Auditing: Network Share Object Was Accessed

Start by examining the specific details of Event ID 5143 to understand the access pattern and identify the source.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 5143 in the Event IDs field and click OK
5. Double-click on a recent Event ID 5143 entry to view details
6. Examine key fields in the event description:
   • Subject: User account and SID making the request
   • Object: Share name and server information
   • Process Information: Application initiating the access
   • Network Information: Source IP address and port
   • Access Request Information: Permissions requested and access mask
7. Note the timestamp and correlate with user activity or system processes
8. Check if the access was successful by looking for corresponding success/failure indicators

Use PowerShell to analyze Event ID 5143 patterns and identify unusual access behavior or high-frequency sources.

1. Open PowerShell as Administrator
2. Query recent Event ID 5143 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143} -MaxEvents 100 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Analyze access patterns by user account:

   $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143} -MaxEvents 1000
   $events | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           UserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           ShareName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
           SourceIP = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
       }
   } | Group-Object UserName | Sort-Object Count -Descending

4. Identify top accessed shares:

   $events | ForEach-Object {
       $xml = [xml]$_.ToXml()
       $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
   } | Group-Object | Sort-Object Count -Descending | Select-Object -First 10

5. Filter events by specific time range:

   $startTime = (Get-Date).AddHours(-24)
   $endTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143; StartTime=$startTime; EndTime=$endTime}

6. Export results to CSV for further analysis:

   $events | Export-Csv -Path "C:\Temp\ShareAccess_5143.csv" -NoTypeInformation

Properly configure Object Access auditing to ensure Event ID 5143 is generated with appropriate detail levels.

1. Open Local Security Policy by running secpol.msc or use Group Policy Management for domain environments
2. Navigate to Security Settings → Local Policies → Audit Policy
3. Double-click Audit object access
4. Enable both Success and Failure auditing
5. For more granular control, use Advanced Audit Policy:

   auditpol /set /subcategory:"File Share" /success:enable /failure:enable

6. Verify current audit settings:

   auditpol /get /subcategory:"File Share"

7. Configure specific share auditing using PowerShell:

   # Enable auditing on a specific share
   $shareName = "SharedDocs"
   $share = Get-SmbShare -Name $shareName
   Set-SmbShare -Name $shareName -FolderEnumerationMode AccessBased

8. Set up System Access Control Lists (SACL) for detailed file access auditing:

   # Configure SACL for a shared folder
   $folderPath = "C:\SharedDocs"
   $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule("Everyone", "FullControl", "ContainerInherit,ObjectInherit", "None", "Success,Failure")
   $acl = Get-Acl $folderPath
   $acl.SetAuditRule($auditRule)
   Set-Acl -Path $folderPath -AclObject $acl

9. Test the configuration by accessing the share and verifying Event ID 5143 generation

Set up automated monitoring and filtering for Event ID 5143 to manage high-volume environments and detect security incidents.

1. Create a custom Event Viewer view for focused monitoring:
   • In Event Viewer, right-click Custom Views and select Create Custom View
   • Select By log and choose Security
   • Enter 5143 in Event IDs field
   • Add additional filters like specific users or time ranges
   • Save the view with a descriptive name like "Share Access Monitoring"
2. Configure Windows Event Forwarding (WEF) for centralized logging:

   # On the collector server
   wecutil qc /q
   # Create subscription for Event ID 5143
   wecutil cs ShareAccessSubscription.xml

3. Set up PowerShell-based monitoring script:

   # Monitor for suspicious share access patterns
   $suspiciousIPs = @("192.168.1.100", "10.0.0.50")
   $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143} -MaxEvents 50
   
   foreach ($event in $events) {
       $xml = [xml]$event.ToXml()
       $sourceIP = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
       
       if ($sourceIP -in $suspiciousIPs) {
           Write-Warning "Suspicious access from $sourceIP at $($event.TimeCreated)"
           # Send alert or log to SIEM
       }
   }

4. Configure Task Scheduler for automated monitoring:

   # Create scheduled task to run monitoring script
   $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorShareAccess.ps1"
   $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15)
   $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "ShareAccessMonitor" -Action $action -Trigger $trigger -Principal $principal

5. Implement log rotation and archival:

   # Configure Security log size and retention
   Limit-EventLog -LogName Security -MaximumSize 512MB -OverflowAction OverwriteAsNeeded

Perform detailed forensic analysis of Event ID 5143 for security investigations and compliance reporting.

1. Export security logs for offline analysis:

   # Export Security log with Event ID 5143 to EVTX format
   wevtutil epl Security C:\Forensics\Security_5143_$(Get-Date -Format 'yyyyMMdd').evtx "/q:*[System[(EventID=5143)]]"
   
   # Convert to CSV for analysis tools
   Get-WinEvent -Path "C:\Forensics\Security_5143_*.evtx" | Export-Csv -Path "C:\Forensics\ShareAccess_Analysis.csv" -NoTypeInformation

2. Correlate with other security events for comprehensive timeline:

   # Correlate Event ID 5143 with logon events (4624, 4625)
   $timeWindow = (Get-Date).AddHours(-2)
   $shareEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143; StartTime=$timeWindow}
   $logonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$timeWindow}
   
   # Create correlation timeline
   $correlatedEvents = @()
   foreach ($shareEvent in $shareEvents) {
       $xml = [xml]$shareEvent.ToXml()
       $userName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       $sourceIP = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
       
       $relatedLogon = $logonEvents | Where-Object {
           $logonXml = [xml]$_.ToXml()
           $logonUser = $logonXml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           $logonIP = $logonXml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
           
           $logonUser -eq $userName -and $logonIP -eq $sourceIP -and 
           [Math]::Abs(($_.TimeCreated - $shareEvent.TimeCreated).TotalMinutes) -lt 30
       }
       
       if ($relatedLogon) {
           $correlatedEvents += [PSCustomObject]@{
               ShareAccessTime = $shareEvent.TimeCreated
               LogonTime = $relatedLogon.TimeCreated
               UserName = $userName
               SourceIP = $sourceIP
               ShareName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
           }
       }
   }

3. Generate compliance reports:

   # Create detailed access report for compliance
   $reportData = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143} -MaxEvents 10000 | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           Timestamp = $_.TimeCreated
           EventID = $_.Id
           UserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           UserDomain = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectDomainName'} | Select-Object -ExpandProperty '#text'
           ShareName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
           SourceIP = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
           AccessMask = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'AccessMask'} | Select-Object -ExpandProperty '#text'
           ProcessName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
       }
   }
   
   # Export to Excel-compatible format
   $reportData | Export-Csv -Path "C:\Reports\ShareAccess_Compliance_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

4. Analyze access patterns for anomaly detection:

   # Detect unusual access patterns
   $baselineHours = 24 * 7  # One week baseline
   $baselineEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143; StartTime=(Get-Date).AddHours(-$baselineHours)}
   
   # Calculate normal access frequency per user
   $userBaseline = $baselineEvents | ForEach-Object {
       $xml = [xml]$_.ToXml()
       $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
   } | Group-Object | ForEach-Object {
       [PSCustomObject]@{
           UserName = $_.Name
           AverageAccessPerHour = $_.Count / $baselineHours
       }
   }
   
   # Compare current hour against baseline
   $currentHourEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143; StartTime=(Get-Date).AddHours(-1)}
   $currentHourAccess = $currentHourEvents | ForEach-Object {
       $xml = [xml]$_.ToXml()
       $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
   } | Group-Object
   
   foreach ($user in $currentHourAccess) {
       $baseline = $userBaseline | Where-Object {$_.UserName -eq $user.Name}
       if ($baseline -and $user.Count -gt ($baseline.AverageAccessPerHour * 3)) {
           Write-Warning "Anomalous access detected for user $($user.Name): $($user.Count) accesses in last hour (baseline: $([math]::Round($baseline.AverageAccessPerHour, 2)))"
       }
   }

5. Integrate with SIEM or security tools:

   # Send high-priority events to SIEM via syslog
   function Send-SyslogMessage {
       param($Message, $Server, $Port = 514)
       $udpClient = New-Object System.Net.Sockets.UdpClient
       $bytes = [System.Text.Encoding]::UTF8.GetBytes($Message)
       $udpClient.Send($bytes, $bytes.Length, $Server, $Port)
       $udpClient.Close()
   }
   
   # Monitor for after-hours access
   $afterHoursEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5143; StartTime=(Get-Date).AddHours(-1)} | Where-Object {
       $hour = $_.TimeCreated.Hour
       $hour -lt 7 -or $hour -gt 19  # Outside 7 AM - 7 PM
   }
   
   foreach ($event in $afterHoursEvents) {
       $xml = [xml]$event.ToXml()
       $message = "ALERT: After-hours share access by $($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text') at $($event.TimeCreated)"
       Send-SyslogMessage -Message $message -Server "siem.company.com"
   }