DFIRHub

Windows event log · Microsoft-Windows-Windows Firewall With Advanced Security/Firewall2011 Windows Firewall unable to notify user of blocked application

  • Defender and policy
  • 3 fields
  • Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
  • Microsoft-Windows-Windows Firewall With Advanced Security

Fields EvtxECmd extracts

3 columns in the EvtxECmd CSV

  • PayloadData1%ModifyingUser%
    • %ModifyingUser% = /Event/EventData/Data[@Name="ModifyingUser"]
  • PayloadData2%ApplicationPath%
    • %ApplicationPath% = /Event/EventData/Data[@Name="ApplicationPath"]
  • PayloadData4Protocol: %Protocol%
    • %Protocol% = /Event/EventData/Data[@Name="Protocol"]

Value lookups

Codes that EvtxECmd turns into text

Protocol

6
TCP
17
UDP
256
All

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Windows Firewall With Advanced Security" Guid="{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}"/>
    <EventID>2011</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime=""/>
    <EventRecordID>13547</EventRecordID>
    <Correlation/>
    <Execution ProcessID="2244" ThreadID="4172"/>
    <Channel>Microsoft-Windows-Windows Firewall With Advanced Security/Firewall</Channel>
    <Computer>HOSTNAME</Computer>
    <Security UserID="S-1-5-19"/>
  </System>
  <EventData>
    <Data Name="ReasonCode">64</Data>
    <Data Name="ApplicationPath">PATH</Data>
    <Data Name="IPVersion">0</Data>
    <Data Name="Protocol">6</Data>
    <Data Name="Port">5405</Data>
    <Data Name="ProcessId">11072</Data>
    <Data Name="ModifyingUser">SID EXECUTING</Data>
  </EventData>
</Event>

References

1 link

Source: evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2011.map(opens in new tab) by Tony Knutson and contributors(opens in new tab), MIT License(opens in new tab)