Remote connection to an administrative share by a user account

Siemphony@siemphonymediumT1021.002unverified

Covers the share-access leg of AN1468: a network connection to the hidden ADMIN$ or C$ share, which is how an operator stages a binary or reaches the service control and task scheduler paths on a remote host. The analytic's ShareName knob has no corresponding field on 4624 or 4648, so the leg is taken from EventID 5140 on the same Security channel, where the share name is actually recorded; the second leg — remote service creation or process execution within a TimeWindow of the access — is a cross-event join Sigma cannot express and must be pivoted to by hand. Machine accounts are excluded because software-deployment and management agents running as SYSTEM generate nearly all benign ADMIN$ traffic, and that exclusion is a known bypass: an NTLM relay or coercion chain arrives as a computer account and will not alert. Both share-access events are off by default and must be turned on first — 5140 needs the *Audit File Share* subcategory, and 5145, which additionally records the file within the share, needs *Audit Detailed File Share* and is far higher volume. Neither is enabled by a clean install or by the Microsoft and CIS baselines, so an empty result means blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0530, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where ((EventID == 5140 and (ShareName endswith "\\ADMIN$" or ShareName endswith "\\C$")) and not (SubjectUserName endswith "$"))

Splunk · SPL

Run this as a search.

index=* ((EventID="5140" AND (ShareName="*\\ADMIN$" OR ShareName="*\\C$")) AND NOT (SubjectUserName="*$"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 5140 AND (TO_LOWER(ShareName) LIKE "*\\\\admin$" OR TO_LOWER(ShareName) LIKE "*\\\\c$")) AND NOT (TO_LOWER(user.name) LIKE "*$"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^5140$</field>    <field name="ShareName" type="pcre2">(?i)(\\ADMIN\$$|\\C\$$)</field>    <field name="SubjectUserName" negate="yes" type="pcre2">(?i)\$$</field>    <description>Remote connection to an administrative share by a user account</description>    <mitre>      <id>T1021.002</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: medium
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a1916bf9-a5ef-4599-99fc-631ce7376f7a

ATT&CKT1021.002

T1021.002SMB/Windows Admin Shares

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

A network connection to the hidden ADMIN$ or C$ share, made by a named user account rather than a machine account. That is the share-access leg of AN1468 — "an SMB-based remote file share access followed by lateral movement actions such as remote service creation, task scheduling, or suspicious process execution". The followed by is a cross-event join inside MITRE's TimeWindow knob that Sigma cannot express and an analyst must pivot to by hand. Reaching ADMIN$ is how an operator stages a binary before hitting the service-control or task-scheduler path, so the first leg is worth watching — but alone it says "someone touched an admin share", not "lateral movement happened".

02 · Telemetry you need

Security EventID 5140, which needs the Audit File Share subcategory. Not on in a clean install, and not in the Microsoft or CIS baselines — an empty result means blind, not quiet. Its louder sibling 5145 additionally records the file within the share, needs Audit Detailed File Share, and is where you go to learn what was staged rather than merely that the share was opened.
One deliberate substitution is worth flagging, because it looks like drift if nobody writes it down. The brief lists AN1468's Security source as 4624 and 4648 — logon session creation. MITRE's ShareName knob has no corresponding field on either; the share name only exists on 5140. So the rule keeps the brief's windows/security logsource verbatim and matches a different EventID within it. That brief.eventIds no longer describes what the rule reads is a recorded decision, not an accident.

03 · How the logic works

Note the escaping, where rules in this corpus usually break. In Sigma \\ is one literal backslash, so a UNC prefix needs four in the YAML. Here '\ADMIN$' is a single backslash, exactly right for the \\*\ADMIN$ value Windows writes into ShareName. Over-escaping would have been the error; the author avoided it. The filter is the whole lesson. Software-deployment and management agents running as SYSTEM generate nearly all benign ADMIN$ traffic and authenticate as the source computer, so SubjectUserName ends in $. Dropping them is what makes this rule survivable — without it the alert volume is the entire patching estate. And it is a zero-cost bypass. Any access originating from a SYSTEM context on the source host arrives as HOST$ and is silently discarded: a scheduled task, a service, a SYSTEM-level shell, PsExec launched from SYSTEM, every NTLM relay or coercion chain. No tooling change, no renaming, no tradecraft — just where you run it from. The rule says so, which is honest; leaving it unnarrowed still means the rule is strongest against the least capable adversary. The shape to carry away: the filter that makes a rule deployable is usually also its bypass. Every exclusion is a specification of what the adversary should do instead. The fix is not deleting the filter — the volume is real — but pairing it with a narrow complement as a separate, lower-volume rule: machine accounts reaching ADMIN$ or C$ on a host that is not their own, or from an IpAddress outside your management ranges. Two smaller gaps. MITRE's ShareName knob names C$, ADMIN$ and IPC$; dropping IPC$ is correct — it fires on essentially every authenticated SMB session — but the trim goes unstated. More materially, D$ through Z$ are missed, so staging to \\host\D$ on a server whose data volume is not C: produces nothing. And there is no loopback filter: 5140 fires for self-referential UNC access from 127.0.0.1 or ::1, which sails past the machine-account filter whenever the local process runs under a named service account — in a rule titled "remote connection".

04 · Common false positives

Deployment and configuration management under a named service account rather
Backup, inventory and vulnerability scanners mounting C$ across the estate
Helpdesk and administrator work. Nothing in 5140 separates an operator
Loopback and self-referential UNC access — installers and admin scripts

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0530 and never executed against logs.
tier_2: begins by confirming Audit File Share is on and 5140 is reaching your index — most estates discover at this step that it is not. Then enumerate the named service accounts in the results and exclude them explicitly.
tier_3: is the join AN1468 describes: share access followed by remote service creation or process execution on the same target inside a five-to-ten minute window — plus the complementary machine-account rule that closes the bypass this one leaves open.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the loopback exclusion first; it removes a class of hits that contradict the title. Add D$ and E$, or a re term for any drive letter followed by $. Then the service accounts, by name, one at a time.
MITRE's UserContext knob — "distinguish expected remote administrators vs. rare/first-time access by specific users" — carries most of the real discrimination, and Sigma cannot express it: rarity is a baseline, not a predicate. Build it in UEBA or as a lookup of account-to-destination pairs seen in the last 30 days. MITRE's ProcessList and TimeWindow knobs describe the second leg and belong in the same layer.

Declared by the author

Software deployment and configuration management run under a named service account rather than SYSTEM. Client push installation, patching and remote script agents connect to ADMIN$ on every managed host, which is the largest benign source that the machine-account exclusion does not remove.
Backup, inventory and vulnerability scanning tools that mount C$ across the estate on a fixed schedule, producing a broad fan-out of accesses from one or two service identities.
Helpdesk and administrator activity that is genuinely remote file copy or remote registry work. Nothing in 5140 separates an operator staging a payload from an administrator fixing a machine, which is why MITRE's UserContext knob — rare or first-time access by a given account — carries most of the discrimination in practice.
Backup or imaging software that impersonates an interactive administrator, and clustered or replicated file services that reach C$ on their partners as part of normal operation.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1021.002, evaluated against their — events.

Share this rule

/u/siemphony/a1916bf9-a5ef-4599-99fc-631ce7376f7a

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote connection to an administrative share by a user account

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it