Possible PetitPotam Coerce Authentication Attempt – Malicious Share Access
The detection rule specifically looks for Windows Security Event ID 5145, which indicates a network share access, where the ShareName starts with '\\' and ends with '\IPC$', the RelativeTargetName is 'lsarpc', and the SubjectUserName is 'ANONYMOUS LOGON'. This combination of events is indicative of a PetitPotam attack attempting to force a domain controller to authenticate to a malicious server.
Microsoft Sentinel (KQL)
