Event ID 5152 — The Windows Filtering Platform blocked a packet.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Audit Policy: Object Access → Filtering Platform Packet Drop
Collection Priority: Low (Microsoft-AppendixL)
Opcode: Info

Description

The Windows Filtering Platform has blocked a packet.

Message #

The Windows Filtering Platform has blocked a packet.

Application Information:
	Process ID: %1
	Application Name: %2

Network Information:
	Direction: %3
	Source Address: %4
	Source Port: %5
	Destination Address: %6
	Destination Port: %7
	Protocol: %8

Filter Information:
	Filter Run-Time ID: %9
	Layer Name: %10
	Layer Run-Time ID: %11

Fields #

Name	Description
`ProcessId` UInt64	[Application Information] Process ID
`Application` UnicodeString	[Application Information] Application Name
`Direction` UnicodeString	[Network Information] Direction Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`SourceAddress` UnicodeString	[Network Information] Source Address
`SourcePort` UnicodeString	[Network Information] Source Port
`DestAddress` UnicodeString	[Network Information] Destination Address
`DestPort` UnicodeString	[Network Information] Destination Port
`Protocol` UInt32	[Network Information] Protocol Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`FilterOrigin` UnicodeString	[Filter Information] Filter Origin
`FilterRTID` UInt64	[Filter Information] Filter Run-Time ID
`LayerName` UnicodeString	[Filter Information] Layer Name Known values `%%14596` IP Packet `%%14597` Transport `%%14598` Forward `%%14599` Stream `%%14600` Datagram Data `%%14601` ICMP Error `%%14602` MAC 802.3 `%%14603` MAC Native `%%14604` vSwitch `%%14608` Resource Assignment `%%14609` Listen `%%14610` Receive/Accept `%%14611` Connect `%%14612` Flow Established `%%14614` Resource Release `%%14615` Endpoint Closure `%%14616` Connect Redirect `%%14617` Bind Redirect `%%14624` Stream Packet `%%14625` Accept Redirect `%%14626` Accept Redirect `%%14640` ICMP Echo-Request `%%14641` vSwitch Ingress `%%14642` vSwitch Egress `%%14643` Unknown
`LayerRTID` UInt64	[Filter Information] Layer Run-Time ID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 5152,
    "version": 1,
    "level": 0,
    "task": 12809,
    "opcode": 0,
    "keywords": 9227875636482146304,
    "time_created": "2026-03-13T20:18:50.483625+00:00",
    "event_record_id": 16258577,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 3152
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProcessId": 0,
    "Application": "-",
    "Direction": "%%14592",
    "SourceAddress": "10.2.10.21",
    "SourcePort": "5355",
    "DestAddress": "10.2.10.11",
    "DestPort": "53173",
    "Protocol": 17,
    "FilterOrigin": "Stealth",
    "FilterRTID": 70356,
    "LayerName": "%%14597",
    "LayerRTID": 13
  },
  "message": ""
}