DFIRHub

Windows event log ยท Security5157 The Windows Filtering Platform has blocked a connection

This event documents each time WFP allows a program to connect to another process (on the same or a remote computer) on a TCP or UDP port.

  • Security
  • 7 fields
  • Security.evtx
  • Microsoft-Windows-Security-Auditing

Notes

  • This event documents each time WFP allows a program to connect to another process (on the same or a remote computer) on a TCP or UDP port.
  • Process ID can be correlated with 4688 Events

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • ExecutableInfo%Application%
    • %Application% = /Event/EventData/Data[@Name="Application"]
  • PayloadData1Source: %SourceAddress%:%SourcePort%
    • %SourceAddress% = /Event/EventData/Data[@Name="SourceAddress"]
    • %SourcePort% = /Event/EventData/Data[@Name="SourcePort"]
  • PayloadData2Dest: %DestAddress%:%DestPort%
    • %DestAddress% = /Event/EventData/Data[@Name="DestAddress"]
    • %DestPort% = /Event/EventData/Data[@Name="DestPort"]
  • PayloadData3Protocol: %Protocol%
    • %Protocol% = /Event/EventData/Data[@Name="Protocol"]
  • PayloadData4PID: %ProcessID%
    • %ProcessID% = /Event/EventData/Data[@Name="ProcessID"]
  • PayloadData5Direction: %Direction%
    • %Direction% = /Event/EventData/Data[@Name="Direction"]
  • PayloadData6LayerName: %LayerName%
    • %LayerName% = /Event/EventData/Data[@Name="LayerName"]

Value lookups

Codes that EvtxECmd turns into text

Protocol

1
Internet Control Message Protocol (ICMP)
3
Gateway-Gateway Protocol (GGP)
6
Transmission Control Protocol (TCP)
8
Exterior Gateway Protocol (EGP)
12
PARC Universal Packet Protocol (PUP)
17
User Datagram Protocol (UDP)
20
Host Monitoring Protocol (HMP)
27
Reliable Datagram Protocol (RDP)
46
Reservation Protocol (RSVP) QoS
47
General Routing Encapsulation (PPTP data over GRE)
50
Encapsulation Security Payload (ESP) IPSec
51
Authentication Header (AH) IPSec
66
MIT Remote Virtual Disk (RVD)
88
Internet Group Management Protocol (IGMP)
89
OSPF Open Shortest Path First

Direction

%%14593
Outbound
%%14592
Inbound

LayerName

%%14597
Transport
%%14601
ICMP Error
%%14608
Resource Assignment
%%14609
Listens
%%14610
Receive/Accept
%%14611
Connect

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/>
    <EventID>5157</EventID>
    <Version>1</Version>
    <Level>0</Level>
    <Task>12810</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2015-09-22T03:46:51.662750400Z"/>
    <EventRecordID>304390</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="4520"/>
    <Channel>Security</Channel>
    <Computer>DC01.contoso.local</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="ProcessID">4556</Data>
    <Data Name="Application">\\device\\harddiskvolume2\\documents\\listener.exe</Data>
    <Data Name="Direction">%%14592</Data>
    <Data Name="SourceAddress">10.0.0.10</Data>
    <Data Name="SourcePort">3333</Data>
    <Data Name="DestAddress">10.0.0.100</Data>
    <Data Name="DestPort">49218</Data>
    <Data Name="Protocol">6</Data>
    <Data Name="FilterRTID">110398</Data>
    <Data Name="LayerName">%%14610</Data>
    <Data Name="LayerRTID">44</Data>
    <Data Name="RemoteUserID">S-1-0-0</Data>
    <Data Name="RemoteMachineID">S-1-0-0</Data>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5157.map(opens in new tab) by Jason Ballard and contributors(opens in new tab), MIT License(opens in new tab)