WFP permitted an outbound/inbound network connection. ProcessName, Direction, SourceAddress, DestAddress, DestPort are key.
C2 communication detection. Beacon traffic from unexpected processes. Data exfiltration patterns. Processes making connections to unusual ports or external IPs. High volume — focus on specific process+destination combinations.
Alert: ProcessName is cmd.exe, PowerShell, mshta, or other unusual processes making external connections. Alert: internal processes connecting to external IPs on unusual ports. High volume — aggregate and alert on anomalies, not individual events.
ApplicationSourceAddressDestAddressDestPortDirection | Tactic | Technique |
|---|---|
| Command and Control | Application Layer Protocol (T1071) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Suspicious Process Making External Network Connection
status: experimental
description: Unexpected process making outbound connection
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 5156
Direction: '%%14593'
Application|endswith:
- '\\cmd.exe'
- '\\powershell.exe'
- '\\mshta.exe'
- '\\wscript.exe'
condition: selection
falsepositives:
- Legitimate admin scripts making web requests
level: medium
tags:
- attack.command_and_control
- attack.t1071SecurityEvent
| where EventID == 5156 // The Windows Filtering Platform has permitted a connection
| project TimeGenerated, Computer, Application, SourceAddress, DestAddress, DestPort, Direction
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=5156
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The Windows Filtering Platform has permitted a connection — add EventData fields: Application, SourceAddress, DestAddress, DestPort`The Windows Filtering Platform has permitted a connection. WFP permitted an outbound/inbound network connection. ProcessName, Direction, SourceAddress, DestAddress, DestPort are key.
Event 5156 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Filtering Platform Connection' subcategory (Success and/or Failure).
Event 5156 is associated with: Application Layer Protocol (T1071).
Alert: ProcessName is cmd.exe, PowerShell, mshta, or other unusual processes making external connections. Alert: internal processes connecting to external IPs on unusual ports. High volume — aggregate and alert on anomalies, not individual events.