An incident responder discovers that an attacker used the Windows 'net use' command to map a remote share before deploying ransomware. Which Windows event ID records this type of network share connection?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Windows Security Event ID 5140 is logged when a network share is accessed, capturing the share name, account name, and source IP — directly relevant to identifying remote share mapping by an attacker. A is wrong because Event ID 4624 records successful logins, which would also appear but does not specifically record share access.
Full explanation below image
Full Explanation
B is correct because Windows Security Event ID 5140 is logged when a network share is accessed, capturing the share name, account name, and source IP — directly relevant to identifying remote share mapping by an attacker. A is wrong because Event ID 4624 records successful logins, which would also appear but does not specifically record share access. C is wrong because Event ID 4688 records process creation, which would show the 'net use' command but not the share access itself. D is wrong because Event ID 1102 records audit log clearing, which is an anti-forensic action, not share access.