WFP permitted application to bind to a local port. Application and LocalPort are key.
Malicious services or backdoors binding to network ports for C2 or lateral movement pivoting. Unusual applications binding to well-known ports.
Alert: unexpected processes binding to common service ports (80, 443, 445, 3389). Alert: processes in temp or user profile directories binding to any port.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5158 // The Windows Filtering Platform has permitted a bind to a local port
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=5158
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The Windows Filtering Platform has permitted a bind to a local port — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`The Windows Filtering Platform has permitted a bind to a local port. WFP permitted application to bind to a local port. Application and LocalPort are key.
Event 5158 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Filtering Platform Connection' subcategory (Success and/or Failure).
Alert: unexpected processes binding to common service ports (80, 443, 445, 3389). Alert: processes in temp or user profile directories binding to any port.