Author: Jason Ballard
Description: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
EventId: 5154
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: ExecutableInfo
    PropertyValue: "%Application%"
    Values:
      -
        Name: Application
        Value: "/Event/EventData/Data[@Name=\"Application\"]"
  -
    Property: PayloadData1
    PropertyValue: "Source: %SourceAddress%:%SourcePort%"
    Values:
      -
        Name: SourceAddress
        Value: "/Event/EventData/Data[@Name=\"SourceAddress\"]"
      -
        Name: SourcePort
        Value: "/Event/EventData/Data[@Name=\"SourcePort\"]"
  -
    Property: PayloadData2
    PropertyValue: "Protocol: %Protocol%"
    Values:
      -
        Name: Protocol
        Value: "/Event/EventData/Data[@Name=\"Protocol\"]"
  -
    Property: PayloadData3
    PropertyValue: "PID: %ProcessId%"
    Values:
      -
        Name: ProcessId
        Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"
  -
    Property: PayloadData4
    PropertyValue: "LayerName: %LayerName%"
    Values:
      -
        Name: LayerName
        Value: "/Event/EventData/Data[@Name=\"LayerName\"]"
        Refine: "%%(.{5})"
Lookups:
  -
    Name: Protocol
    Default: Unknown code
    Values:
      1: Internet Control Message Protocol (ICMP)
      6: Transmission Control Protocol (TCP)
      17: User Datagram Protocol (UDP)
      47: General Routing Encapsulation (PPTP data over GRE)
      51: Authentication Header (AH) IPSec
      50: Encapsulation Security Payload (ESP) IPSec
      8: Exterior Gateway Protocol (EGP)
      3: Gateway-Gateway Protocol (GGP)
      20: Host Monitoring Protocol (HMP)
      88: Internet Group Management Protocol (IGMP)
      66: MIT Remote Virtual Disk (RVD)
      89: OSPF Open Shortest Path First
      12: PARC Universal Packet Protocol (PUP)
      27: Reliable Datagram Protocol (RDP)
      46: Reservation Protocol (RSVP) QoS
  -
    Name: LayerName
    Default: Unknown code
    Values:
      "%%14597": Transport
      "%%14601": ICMP Error
      "%%14608": Resource Assignment
      "%%14609": Listen
      "%%14610": Receive/Accept
      "%%14611": Connect

# Documentation:
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5154
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# This event documents each time WFP allows a program to begin listening on a TCP or UDP port for incoming connections and documents the program, port and filter that allowed it.
#
# <Event>
# <System>
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d" />
# <EventID>5154</EventID>
# <Version>0</Version>
# <Level>0</Level>
# <Task>12810</Task>
# <Opcode>0</Opcode>
# <Keywords>0x8020000000000000</Keywords>
# <TimeCreated SystemTime="2021-12-06 07:35:44.3515332" />
# <EventRecordID>173889</EventRecordID>
# <Correlation />
# <Execution ProcessID="4" ThreadID="10016" />
# <Channel>Security</Channel>
# <Computer>1337-H4x0r</Computer>
# <Security />
# </System>
# <EventData>
# <Data Name="ProcessId">728</Data>
# <Data Name="Application">\device\harddiskvolume3\windows\system32\services.exe</Data>
# <Data Name="SourceAddress">::</Data>
# <Data Name="SourcePort">49669</Data>
# <Data Name="Protocol">6</Data>
# <Data Name="FilterRTID">0</Data>
# <Data Name="LayerName">%%14609</Data>
# <Data Name="LayerRTID">42</Data>
# </EventData>
# </Event>
