WFP blocked a network connection. Indicates a firewall rule blocked traffic.
Blocked connections from attack tools can indicate attacker enumeration of firewall rules. High volume of blocks from a single process may indicate port scanning or C2 beacon failures.
Alert: clustered blocks from PowerShell or cmd. Alert: blocks indicating lateral movement attempt (SMB, RDP to internal hosts in rapid succession).
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5157 // The Windows Filtering Platform has blocked a connection
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=5157
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The Windows Filtering Platform has blocked a connection — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`The Windows Filtering Platform has blocked a connection. WFP blocked a network connection. Indicates a firewall rule blocked traffic.
Event 5157 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Filtering Platform Connection' subcategory (Success and/or Failure).
Alert: clustered blocks from PowerShell or cmd. Alert: blocks indicating lateral movement attempt (SMB, RDP to internal hosts in rapid succession).