Windows Event ID 5144 – Microsoft-Windows-Security-Auditing: Network Share Object Access Attempted

Start by examining the specific details of Event ID 5144 to understand the access attempt context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5144 by right-clicking the Security log and selecting Filter Current Log
4. In the filter dialog, enter 5144 in the Event IDs field and click OK
5. Double-click on a 5144 event to view detailed information including:
   • Subject: User account that attempted access
   • Object: Target share path and resource name
   • Access Request Information: Permissions requested
   • Process Information: Application that initiated the request
6. Note the Access Mask value to understand specific permissions requested
7. Check the Result Code to determine if access was granted or denied

Use PowerShell to analyze Event ID 5144 patterns and identify trends or suspicious activity.

1. Open PowerShell as Administrator
2. Query recent 5144 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5144} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific user account:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5144} -MaxEvents 1000
   $Events | Where-Object {$_.Message -like '*DOMAIN\username*'} | Select-Object TimeCreated, Message

4. Analyze access patterns by share path:

   $ShareAccess = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5144} -MaxEvents 500
   $ShareAccess | ForEach-Object {
       if ($_.Message -match 'Object Name:\s+(.+)') {
           [PSCustomObject]@{
               Time = $_.TimeCreated
               SharePath = $matches[1].Trim()
               User = if ($_.Message -match 'Account Name:\s+(.+)') { $matches[1].Trim() }
           }
       }
   } | Group-Object SharePath | Sort-Object Count -Descending

5. Export results for further analysis:

   $Results | Export-Csv -Path "C:\Temp\ShareAccess_5144.csv" -NoTypeInformation

Ensure proper audit policy configuration to capture comprehensive Event ID 5144 data.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies
3. Expand Object Access and configure the following policies:
   • Audit File Share: Set to Success and Failure
   • Audit File System: Set to Success and Failure
   • Audit Handle Manipulation: Set to Success (optional)
4. Apply the policy using PowerShell for immediate effect:

   auditpol /set /subcategory:"File Share" /success:enable /failure:enable
   auditpol /set /subcategory:"File System" /success:enable /failure:enable

5. Verify current audit settings:

   auditpol /get /subcategory:"File Share"
   auditpol /get /subcategory:"File System"

6. Configure specific share auditing by setting SACL (System Access Control List) on target shares:

   icacls "\\server\share" /grant "Everyone:(OI)(CI)(F)" /audit "Everyone:(OI)(CI)(F)"

7. Force Group Policy update:

   gpupdate /force

Set up centralized collection of Event ID 5144 for enterprise-wide monitoring and analysis.

1. Configure the Windows Event Collector service on your central logging server:

   wecutil qc /q

2. Create a custom event subscription configuration file (ShareAccess_5144.xml):

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>ShareAccess_5144</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Collect Event ID 5144 from domain computers</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <ConfigurationMode>Custom</ConfigurationMode>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=5144]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

3. Import the subscription:

   wecutil cs ShareAccess_5144.xml

4. Configure source computers to forward events:

   winrm quickconfig
   wecutil qc

5. Add computers to the subscription:

   wecutil ss ShareAccess_5144 /ca:"DOMAIN\Computer1$,DOMAIN\Computer2$"

6. Verify subscription status:

   wecutil gs ShareAccess_5144

7. Monitor forwarded events in the Forwarded Events log on the collector server

Implement advanced threat detection by correlating Event ID 5144 with other security events in your SIEM platform.

1. Configure your SIEM agent (Splunk Universal Forwarder, Elastic Beats, etc.) to collect Security log events:

   # Example Splunk inputs.conf configuration
   [WinEventLog://Security]
   disabled = false
   start_from = oldest
   current_only = false
   checkpointInterval = 5
   whitelist = 5144

2. Create a PowerShell script for custom alerting on suspicious patterns:

   $SuspiciousPatterns = @(
       "\\.*\\ADMIN\$",
       "\\.*\\C\$",
       "\\.*\\SYSVOL"
   )
   
   $RecentEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5144; StartTime=(Get-Date).AddHours(-1)}
   
   foreach ($Event in $RecentEvents) {
       foreach ($Pattern in $SuspiciousPatterns) {
           if ($Event.Message -match $Pattern) {
               $Alert = @{
                   Time = $Event.TimeCreated
                   Computer = $Event.MachineName
                   User = if ($Event.Message -match 'Account Name:\s+(.+)') { $matches[1] }
                   SharePath = if ($Event.Message -match 'Object Name:\s+(.+)') { $matches[1] }
                   Severity = "High"
               }
               # Send alert to SIEM or notification system
               Write-Warning "Suspicious share access detected: $($Alert | ConvertTo-Json)"
           }
       }
   }

3. Set up correlation rules in your SIEM to detect:
   • Multiple failed access attempts from the same user
   • Access to administrative shares outside business hours
   • Unusual access patterns compared to user baselines
   • Rapid sequential access to multiple shares
4. Configure automated response actions:
   • Disable user accounts after threshold violations
   • Generate incident tickets for security team review
   • Trigger additional monitoring on affected systems
5. Create dashboards for real-time monitoring of share access trends and anomalies