Author: Jason Ballard
Description: The Windows Filtering Platform has blocked a connection
EventId: 5157
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: ExecutableInfo
    PropertyValue: "%Application%"
    Values:
      -
        Name: Application
        Value: "/Event/EventData/Data[@Name=\"Application\"]"
  -
    Property: PayloadData1
    PropertyValue: "Source: %SourceAddress%:%SourcePort%"
    Values:
      -
        Name: SourceAddress
        Value: "/Event/EventData/Data[@Name=\"SourceAddress\"]"
      -
        Name: SourcePort
        Value: "/Event/EventData/Data[@Name=\"SourcePort\"]"
  -
    Property: PayloadData2
    PropertyValue: "Dest: %DestAddress%:%DestPort%"
    Values:
      -
        Name: DestAddress
        Value: "/Event/EventData/Data[@Name=\"DestAddress\"]"
      -
        Name: DestPort
        Value: "/Event/EventData/Data[@Name=\"DestPort\"]"
  -
    Property: PayloadData3
    PropertyValue: "Protocol: %Protocol%"
    Values:
      -
        Name: Protocol
        Value: "/Event/EventData/Data[@Name=\"Protocol\"]"
  -
    Property: PayloadData4
    PropertyValue: "PID: %ProcessID%"
    Values:
      -
        Name: ProcessID
        Value: "/Event/EventData/Data[@Name=\"ProcessID\"]"
  -
    Property: PayloadData5
    PropertyValue: "Direction: %Direction%"
    Values:
      -
        Name: Direction
        Value: "/Event/EventData/Data[@Name=\"Direction\"]"
        Refine: "%%(.{5})"
  -
    Property: PayloadData6
    PropertyValue: "LayerName: %LayerName%"
    Values:
      -
        Name: LayerName
        Value: "/Event/EventData/Data[@Name=\"LayerName\"]"
        Refine: "%%(.{5})"
Lookups:
  -
    Name: Protocol
    Default: Unknown code
    Values:
      1: Internet Control Message Protocol (ICMP)
      6: Transmission Control Protocol (TCP)
      17: User Datagram Protocol (UDP)
      3: Gateway-Gateway Protocol (GGP)
      8: Exterior Gateway Protocol (EGP)
      12: PARC Universal Packet Protocol (PUP)
      20: Host Monitoring Protocol (HMP)
      27: Reliable Datagram Protocol (RDP)
      46: Reservation Protocol (RSVP) QoS
      47: General Routing Encapsulation (PPTP data over GRE)
      51: Authentication Header (AH) IPSec
      50: Encapsulation Security Payload (ESP) IPSec
      66: MIT Remote Virtual Disk (RVD)
      88: Internet Group Management Protocol (IGMP)
      89: OSPF Open Shortest Path First
  -
    Name: Direction
    Default: Unknown code
    Values:
      "%%14593": Outbound
      "%%14592": Inbound
  -
    Name: LayerName
    Default: Unknown code
    Values:
      "%%14597": Transport
      "%%14601": ICMP Error
      "%%14608": Resource Assignment
      "%%14609": Listens
      "%%14610": Receive/Accept
      "%%14611": Connect

# Documentation:
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5157
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# This event documents each time WFP allows a program to connect to another process (on the same or a remote computer) on a TCP or UDP port.
# Process ID can be correlated with 4688 Events
#
# - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
# - <System>
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
# <EventID>5157</EventID>
# <Version>1</Version>
# <Level>0</Level>
# <Task>12810</Task>
# <Opcode>0</Opcode>
# <Keywords>0x8010000000000000</Keywords>
# <TimeCreated SystemTime="2015-09-22T03:46:51.662750400Z" />
# <EventRecordID>304390</EventRecordID>
# <Correlation />
# <Execution ProcessID="4" ThreadID="4520" />
# <Channel>Security</Channel>
# <Computer>DC01.contoso.local</Computer>
# <Security />
# </System>
# - <EventData>
# <Data Name="ProcessID">4556</Data>
# <Data Name="Application">\\device\\harddiskvolume2\\documents\\listener.exe</Data>
# <Data Name="Direction">%%14592</Data>
# <Data Name="SourceAddress">10.0.0.10</Data>
# <Data Name="SourcePort">3333</Data>
# <Data Name="DestAddress">10.0.0.100</Data>
# <Data Name="DestPort">49218</Data>
# <Data Name="Protocol">6</Data>
# <Data Name="FilterRTID">110398</Data>
# <Data Name="LayerName">%%14610</Data>
# <Data Name="LayerRTID">44</Data>
# <Data Name="RemoteUserID">S-1-0-0</Data>
# <Data Name="RemoteMachineID">S-1-0-0</Data>
# </EventData>
# </Event>
