Access To ADMIN$ Network Share
This rule detects attempts to access the hidden administrative network share 'ADMIN$' on Windows systems. The 'ADMIN$' share is a default hidden share that maps to the Windows directory (usually C:\Windows) and is primarily used for remote administration. Adversaries often leverage these administrative shares for lateral movement, file transfer, and remote execution within a compromised network. The rule specifically looks for Event ID 5140, which indicates a network share object was accessed, and filters for the 'Admin$' ShareName. It also filters out access from computer accounts (ending with '$') to reduce false positives from legitimate system activities.
Sigma
