How do you detect ADMIN$ and C$ share abuse?

Detect admin share abuse by focusing on writes and their origin. Security Event ID 5140 shows the first access to a share and Event 5145 records file-level requests, so alert on writes of executables, DLLs and scripts to ADMIN$ or C$ from sources that are not approved administration hosts. Add Sysmon Event 11, where files created by the System process in the Windows directory indicate an SMB drop, and correlate with a service creation or scheduled task on the same target within a minute. Zeek smb_files and smb_mapping logs or Suricata SMB buffers cover hosts without full auditing. Scope Event 5145 auditing carefully because of its volume.

Detecting ADMIN$, C$ and IPC$ Share Abuse

ADMIN$ maps to the Windows directory, C$ to the system drive and IPC$ carries named pipes. PsExec, smbexec, wmiexec, secretsdump and many ransomware deployers use them to stage binaries or read output. Because the shares exist on every host, the detection signal is the write and its origin, not the share name.

Signals at a Glance

Signal	Where	ATT&CK
Network share accessed with ADMIN$ or C$ (first connect)	Security 5140	T1021.002
Detailed file-share access with write access to an executable or script	Security 5145	T1570
Executable or DLL created in the Windows directory by the System process	Sysmon 11	T1570
IPC$ access to named pipes such as svcctl, atsvc, winreg, lsarpc	Security 5145, Zeek smb	T1021.002
One source connecting to ADMIN$ on many hosts in minutes	Zeek smb_mapping, 5140	T1021.002

Share Events and Write Detection

Event 5140 fires once per session when a share is accessed; Event 5145 logs each file-level request and is the one that shows what was written. 5145 is voluminous, so scope the audit policy to the administrative shares or collect it only on servers and sensitive hosts. A starting-point search for writes of executable content:

index=wineventlog EventCode=5145 (Share_Name="\\\\*\\ADMIN$" OR Share_Name="\\\\*\\C$")
  (Relative_Target_Name="*.exe" OR Relative_Target_Name="*.dll" OR Relative_Target_Name="*.bat"
   OR Relative_Target_Name="*.ps1" OR Relative_Target_Name="*.sys")
  Access_Mask IN ("0x2", "0x6", "0x12019f", "0x1f01ff")
| stats count values(Relative_Target_Name) as files dc(Relative_Target_Name) as n
        by Source_Address, Account_Name, ComputerName
| sort - n
# tune/validate: access-mask values differ by client; confirm with a PsExec test in a lab.

Pair it with the file-creation event on the endpoint, which names the file even if share auditing was not enabled. Writes arriving over SMB are attributed to the System process, so a PE file created by System in the Windows directory is a strong indicator:

// Microsoft Defender (KQL) - executable dropped into system paths by SMB service context
DeviceFileEvents
| where ActionType == "FileCreated"
| where InitiatingProcessFileName =~ "System" or InitiatingProcessId == 4
| where FolderPath startswith @"C:\Windows\" and FileName endswith_cs ".exe"
| where FolderPath !has @"\WinSxS\" and FolderPath !has @"\servicing\"
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessAccountName
// tune/validate: initiating-process attribution for SMB writes varies by product.

Network Visibility

If host auditing is incomplete, SMB is visible on the wire. Zeek logs share mappings in smb_mapping.log and file operations in smb_files.log. Suricata 7 exposes SMB sticky buffers for share names and pipes:

# Suricata (validate syntax against your version and rule engine)
alert smb any any -> $HOME_NET 445 ( \
  msg:"HUNT SMB tree connect to ADMIN$ from non-admin source"; \
  flow:established,to_server; \
  smb.share; content:"ADMIN$"; nocase; \
  threshold:type both, track by_src, count 5, seconds 300; \
  classtype:policy-violation; sid:9100001; rev:1; )
# tune/validate: add a negation for approved admin subnets using a variable such as $ADMIN_NETS.

Keep a list of hosts allowed to administer others (jump hosts, patching servers) and alert on every other source touching ADMIN$ or C$.
Pair the first access to ADMIN$ (5140) with a service creation or task registration on the same target within one minute, since that sequence is the full execution chain.
Disable administrative shares only where they are not needed; for the rest, block 445 between workstations with host firewalls so share abuse cannot start.

Vetted sources

Use the SigmaHQ admin-share and SMB rules, Elastic and Splunk ESCU SMB lateral movement content and MITRE CAR analytics for remote file copy. Zeek smb logs and Suricata give a host-independent view, and Atomic Red Team can replay share access. Baseline your own environment: backup, antivirus update and software distribution systems use these shares legitimately.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Share Events and Write Detection

Network Visibility

Build Detections That Fire

Lateral Movement Detection

Detection Hub

PsExec Detection

Remote Registry Abuse Detection