Author: Jason Ballard
Description: The Windows Filtering Platform has permitted a bind to a local port
EventId: 5158
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: ExecutableInfo
    PropertyValue: "%Application%"
    Values:
      -
        Name: Application
        Value: "/Event/EventData/Data[@Name=\"Application\"]"
  -
    Property: PayloadData1
    PropertyValue: "Source: %SourceAddress%:%SourcePort%"
    Values:
      -
        Name: SourceAddress
        Value: "/Event/EventData/Data[@Name=\"SourceAddress\"]"
      -
        Name: SourcePort
        Value: "/Event/EventData/Data[@Name=\"SourcePort\"]"
  -
    Property: PayloadData2
    PropertyValue: "Protocol: %Protocol%"
    Values:
      -
        Name: Protocol
        Value: "/Event/EventData/Data[@Name=\"Protocol\"]"
  -
    Property: PayloadData3
    PropertyValue: "PID: %ProcessId%"
    Values:
      -
        Name: ProcessId
        Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"
  -
    Property: PayloadData4
    PropertyValue: "LayerName: %LayerName%"
    Values:
      -
        Name: LayerName
        Value: "/Event/EventData/Data[@Name=\"LayerName\"]"
        Refine: "%%(.{5})"
Lookups:
  -
    Name: Protocol
    Default: Unknown code
    Values:
      1: Internet Control Message Protocol (ICMP)
      6: Transmission Control Protocol (TCP)
      17: User Datagram Protocol (UDP)
      47: General Routing Encapsulation (PPTP data over GRE)
      51: Authentication Header (AH) IPSec
      50: Encapsulation Security Payload (ESP) IPSec
      8: Exterior Gateway Protocol (EGP)
      3: Gateway-Gateway Protocol (GGP)
      20: Host Monitoring Protocol (HMP)
      88: Internet Group Management Protocol (IGMP)
      66: MIT Remote Virtual Disk (RVD)
      89: OSPF Open Shortest Path First
      12: PARC Universal Packet Protocol (PUP)
      27: Reliable Datagram Protocol (RDP)
      46: Reservation Protocol (RSVP) QoS
  -
    Name: LayerName
    Default: Unknown code
    Values:
      "%%14597": Transport
      "%%14601": ICMP Error
      "%%14608": Resource Assignment
      "%%14609": Listen
      "%%14610": Receive/Accept
      "%%14611": Connect

# Documentation:
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5158
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# This event is logged every time a client or server application binds to a port.  Binding is the first step in TCP/UDP communications.
# For server applications, subsequent to this event you will see 5154 or 5031 when the server attempts to begin listening on the port.
#
# - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
# - <System>
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
# <EventID>5158</EventID>
# <Version>0</Version>
# <Level>0</Level>
# <Task>12810</Task>
# <Opcode>0</Opcode>
# <Keywords>0x8020000000000000</Keywords>
# <TimeCreated SystemTime="2015-09-22T05:24:03.376171200Z" />
# <EventRecordID>308122</EventRecordID>
# <Correlation />
# <Execution ProcessID="4" ThreadID="3712" />
# <Channel>Security</Channel>
# <Computer>DC01.contoso.local</Computer>
# <Security />
# </System>
# - <EventData>
# <Data Name="ProcessId">4556</Data>
# <Data Name="Application">\\device\\harddiskvolume2\\documents\\listener.exe</Data>
# <Data Name="SourceAddress">0.0.0.0</Data>
# <Data Name="SourcePort">3333</Data>
# <Data Name="Protocol">6</Data>
# <Data Name="FilterRTID">0</Data>
# <Data Name="LayerName">%%14608</Data>
# <Data Name="LayerRTID">36</Data>
# </EventData>
# </Event>
