detection.wiki

Microsoft-Windows-Security-Auditing › Event 5156

Event ID 5156 — The Windows Filtering Platform has permitted a connection.

Provider
Microsoft-Windows-Security-Auditing
Channel
Security
Audit Policy
Object Access → Filtering Platform Connection
Collection Priority
Recommended (Yamato Security, others)
Opcode
Info

Description

The Windows Filtering Platform has permitted a connection.

Message #

The Windows Filtering Platform has permitted a connection.

Application Information:
	Process ID: %1
	Application Name: %2

Network Information:
	Direction: %3
	Source Address: %4
	Source Port: %5
	Destination Address: %6
	Destination Port: %7
	Protocol: %8

Filter Information:
	Filter Run-Time ID: %9
	Layer Name: %10
	Layer Run-Time ID: %11

Fields #

NameDescription
ProcessID UInt64[Application Information] Process ID
Application UnicodeString[Application Information] Application Name
Direction UnicodeString[Network Information] Direction
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
SourceAddress UnicodeString[Network Information] Source Address
SourcePort UnicodeString[Network Information] Source Port
DestAddress UnicodeString[Network Information] Destination Address
DestPort UnicodeString[Network Information] Destination Port
Protocol UInt32[Network Information] Protocol
Known values
0
HOPOPT
1
ICMP
2
IGMP
6
TCP
17
UDP
41
IPv6
43
IPv6-Route
44
IPv6-Frag
47
GRE
50
ESP
51
AH
58
ICMPv6
89
OSPF
103
PIM
132
SCTP
FilterRTID UInt64[Filter Information] Filter Run-Time ID
LayerName UnicodeString[Filter Information] Layer Name
Known values
%%14596
IP Packet
%%14597
Transport
%%14598
Forward
%%14599
Stream
%%14600
Datagram Data
%%14601
ICMP Error
%%14602
MAC 802.3
%%14603
MAC Native
%%14604
vSwitch
%%14608
Resource Assignment
%%14609
Listen
%%14610
Receive/Accept
%%14611
Connect
%%14612
Flow Established
%%14614
Resource Release
%%14615
Endpoint Closure
%%14616
Connect Redirect
%%14617
Bind Redirect
%%14624
Stream Packet
%%14625
Accept Redirect
%%14626
Accept Redirect
%%14640
ICMP Echo-Request
%%14641
vSwitch Ingress
%%14642
vSwitch Egress
%%14643
Unknown
LayerRTID UInt64[Filter Information] Layer Run-Time ID
RemoteUserID SID[Filter Information] Remote User ID
RemoteMachineID SID[Filter Information] Remote Machine ID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 5156,
    "version": 1,
    "level": 0,
    "task": 12810,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2019-02-13T18:01:47.512340Z",
    "event_record_id": 227694,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 56
    },
    "channel": "Security",
    "computer": "PC01.example.corp",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProcessID": 820,
    "Application": "\\device\\harddiskvolume1\\windows\\system32\\svchost.exe",
    "Direction": "%%14593",
    "SourceAddress": "fe80::80ac:4126:fa58:1b81",
    "SourcePort": "546",
    "DestAddress": "ff02::1:2",
    "DestPort": "547",
    "Protocol": 17,
    "FilterRTID": 65865,
    "LayerName": "%%14611",
    "LayerRTID": 50,
    "RemoteUserID": "S-1-0-0",
    "RemoteMachineID": "S-1-0-0"
  }
}

Detection Patterns #

Community Notes #

Indicates what process (application path) on the local machine made an outbound connection to a specific destination IP and port. Helpful for reviewing connections made by a suspect process.

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Kusto Query Language # view in reference

  • Zinc Actor IOCs files - October 2022 source high: 'Identifies a match across filename and commandline IOC's related to an actor tracked by Microsoft as Zinc. Reference: https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/'

References #