Skip to content

Commit 84f30b7

Browse files
AndrewRathbunAndrewRathbun
authored
Merge pull request #180 from jball77-git/jball77/515X
Jball77/515 x
2 parents 3ee2322 + 68aa256 commit 84f30b7

6 files changed

+680
-32
lines changed

‎evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5152.map

+142
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
Author: Jason Ballard
2+
Description: The Windows Filtering Platform has blocked a packet
3+
EventId: 5152
4+
Channel: Security
5+
Provider: Microsoft-Windows-Security-Auditing
6+
Maps:
7+
-
8+
Property: ExecutableInfo
9+
PropertyValue: "%Application%"
10+
Values:
11+
-
12+
Name: Application
13+
Value: "/Event/EventData/Data[@Name=\"Application\"]"
14+
-
15+
Property: PayloadData1
16+
PropertyValue: "Source: %SourceAddress%:%SourcePort%"
17+
Values:
18+
-
19+
Name: SourceAddress
20+
Value: "/Event/EventData/Data[@Name=\"SourceAddress\"]"
21+
-
22+
Name: SourcePort
23+
Value: "/Event/EventData/Data[@Name=\"SourcePort\"]"
24+
-
25+
Property: PayloadData2
26+
PropertyValue: "Dest: %DestAddress%:%DestPort%"
27+
Values:
28+
-
29+
Name: DestAddress
30+
Value: "/Event/EventData/Data[@Name=\"DestAddress\"]"
31+
-
32+
Name: DestPort
33+
Value: "/Event/EventData/Data[@Name=\"DestPort\"]"
34+
-
35+
Property: PayloadData3
36+
PropertyValue: "Protocol: %Protocol%"
37+
Values:
38+
-
39+
Name: Protocol
40+
Value: "/Event/EventData/Data[@Name=\"Protocol\"]"
41+
-
42+
Property: PayloadData4
43+
PropertyValue: "PID: %ProcessID%"
44+
Values:
45+
-
46+
Name: ProcessID
47+
Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"
48+
-
49+
Property: PayloadData5
50+
PropertyValue: "Direction: %Direction%"
51+
Values:
52+
-
53+
Name: Direction
54+
Value: "/Event/EventData/Data[@Name=\"Direction\"]"
55+
Refine: "%%(.{5})"
56+
-
57+
Property: PayloadData6
58+
PropertyValue: "LayerName: %LayerName%"
59+
Values:
60+
-
61+
Name: LayerName
62+
Value: "/Event/EventData/Data[@Name=\"LayerName\"]"
63+
Refine: "%%(.{5})"
64+
Lookups:
65+
-
66+
Name: Protocol
67+
Default: Unknown code
68+
Values:
69+
1: Internet Control Message Protocol (ICMP)
70+
6: Transmission Control Protocol (TCP)
71+
17: User Datagram Protocol (UDP)
72+
3: Gateway-Gateway Protocol (GGP)
73+
8: Exterior Gateway Protocol (EGP)
74+
12: PARC Universal Packet Protocol (PUP)
75+
20: Host Monitoring Protocol (HMP)
76+
27: Reliable Datagram Protocol (RDP)
77+
46: Reservation Protocol (RSVP) QoS
78+
47: General Routing Encapsulation (PPTP data over GRE)
79+
51: Authentication Header (AH) IPSec
80+
50: Encapsulation Security Payload (ESP) IPSec
81+
66: MIT Remote Virtual Disk (RVD)
82+
88: Internet Group Management Protocol (IGMP)
83+
89: OSPF Open Shortest Path First
84+
-
85+
Name: Direction
86+
Default: Unknown code
87+
Values:
88+
"%%14593": Outbound
89+
"%%14592": Inbound
90+
-
91+
Name: LayerName
92+
Default: Unknown code
93+
Values:
94+
"%%14597": Transport
95+
"%%14601": ICMP Error
96+
"%%14608": Resource Assignment
97+
"%%14609": Listen
98+
"%%14610": Receive/Accept
99+
"%%14611": Connect
100+
101+
# Documentation:
102+
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152
103+
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5152
104+
#
105+
# This event logs all the particulars about a blocked packet including the filter that caused the block.
106+
# Application Information:
107+
# Process ID: process ID specified when the executable started as logged in 4688
108+
# Application Name: the program executable on this computer's side of the packet transmission
109+
# Process ID can be correlated with 4688 Events
110+
#
111+
# - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
112+
# - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
113+
# - <System>
114+
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
115+
# <EventID>5152</EventID>
116+
# <Version>0</Version>
117+
# <Level>0</Level>
118+
# <Task>12809</Task>
119+
# <Opcode>0</Opcode>
120+
# <Keywords>0x8010000000000000</Keywords>
121+
# <TimeCreated SystemTime="2015-09-22T16:52:37.274367300Z" />
122+
# <EventRecordID>321323</EventRecordID>
123+
# <Correlation />
124+
# <Execution ProcessID="4" ThreadID="4456" />
125+
# <Channel>Security</Channel>
126+
# <Computer>DC01.contoso.local</Computer>
127+
# <Security />
128+
# </System>
129+
# - <EventData>
130+
# <Data Name="ProcessId">4556</Data>
131+
# <Data Name="Application">\\device\\harddiskvolume2\\documents\\listener.exe</Data>
132+
# <Data Name="Direction">%%14592</Data>
133+
# <Data Name="SourceAddress">10.0.0.100</Data>
134+
# <Data Name="SourcePort">49278</Data>
135+
# <Data Name="DestAddress">10.0.0.10</Data>
136+
# <Data Name="DestPort">3333</Data>
137+
# <Data Name="Protocol">6</Data>
138+
# <Data Name="FilterRTID">0</Data>
139+
# <Data Name="LayerName">%%14610</Data>
140+
# <Data Name="LayerRTID">44</Data>
141+
# </EventData>
142+
# </Event>

‎evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5154.map

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
Author: Jason Ballard
2+
Description: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
3+
EventId: 5154
4+
Channel: Security
5+
Provider: Microsoft-Windows-Security-Auditing
6+
Maps:
7+
-
8+
Property: ExecutableInfo
9+
PropertyValue: "%Application%"
10+
Values:
11+
-
12+
Name: Application
13+
Value: "/Event/EventData/Data[@Name=\"Application\"]"
14+
-
15+
Property: PayloadData1
16+
PropertyValue: "Source: %SourceAddress%:%SourcePort%"
17+
Values:
18+
-
19+
Name: SourceAddress
20+
Value: "/Event/EventData/Data[@Name=\"SourceAddress\"]"
21+
-
22+
Name: SourcePort
23+
Value: "/Event/EventData/Data[@Name=\"SourcePort\"]"
24+
-
25+
Property: PayloadData2
26+
PropertyValue: "Protocol: %Protocol%"
27+
Values:
28+
-
29+
Name: Protocol
30+
Value: "/Event/EventData/Data[@Name=\"Protocol\"]"
31+
-
32+
Property: PayloadData3
33+
PropertyValue: "PID: %ProcessId%"
34+
Values:
35+
-
36+
Name: ProcessId
37+
Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"
38+
-
39+
Property: PayloadData4
40+
PropertyValue: "LayerName: %LayerName%"
41+
Values:
42+
-
43+
Name: LayerName
44+
Value: "/Event/EventData/Data[@Name=\"LayerName\"]"
45+
Refine: "%%(.{5})"
46+
Lookups:
47+
-
48+
Name: Protocol
49+
Default: Unknown code
50+
Values:
51+
1: Internet Control Message Protocol (ICMP)
52+
6: Transmission Control Protocol (TCP)
53+
17: User Datagram Protocol (UDP)
54+
47: General Routing Encapsulation (PPTP data over GRE)
55+
51: Authentication Header (AH) IPSec
56+
50: Encapsulation Security Payload (ESP) IPSec
57+
8: Exterior Gateway Protocol (EGP)
58+
3: Gateway-Gateway Protocol (GGP)
59+
20: Host Monitoring Protocol (HMP)
60+
88: Internet Group Management Protocol (IGMP)
61+
66: MIT Remote Virtual Disk (RVD)
62+
89: OSPF Open Shortest Path First
63+
12: PARC Universal Packet Protocol (PUP)
64+
27: Reliable Datagram Protocol (RDP)
65+
46: Reservation Protocol (RSVP) QoS
66+
-
67+
Name: LayerName
68+
Default: Unknown code
69+
Values:
70+
"%%14597": Transport
71+
"%%14601": ICMP Error
72+
"%%14608": Resource Assignment
73+
"%%14609": Listen
74+
"%%14610": Receive/Accept
75+
"%%14611": Connect
76+
77+
# Documentation:
78+
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5154
79+
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154
80+
#
81+
# This event documents each time WFP allows a program to begin listening on a TCP or UDP port for incoming connections and documents the program, port and filter that allowed it.
82+
#
83+
# <Event>
84+
# <System>
85+
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d" />
86+
# <EventID>5154</EventID>
87+
# <Version>0</Version>
88+
# <Level>0</Level>
89+
# <Task>12810</Task>
90+
# <Opcode>0</Opcode>
91+
# <Keywords>0x8020000000000000</Keywords>
92+
# <TimeCreated SystemTime="2021-12-06 07:35:44.3515332" />
93+
# <EventRecordID>173889</EventRecordID>
94+
# <Correlation />
95+
# <Execution ProcessID="4" ThreadID="10016" />
96+
# <Channel>Security</Channel>
97+
# <Computer>1337-H4x0r</Computer>
98+
# <Security />
99+
# </System>
100+
# <EventData>
101+
# <Data Name="ProcessId">728</Data>
102+
# <Data Name="Application">\device\harddiskvolume3\windows\system32\services.exe</Data>
103+
# <Data Name="SourceAddress">::</Data>
104+
# <Data Name="SourcePort">49669</Data>
105+
# <Data Name="Protocol">6</Data>
106+
# <Data Name="FilterRTID">0</Data>
107+
# <Data Name="LayerName">%%14609</Data>
108+
# <Data Name="LayerRTID">42</Data>
109+
# </EventData>
110+
# </Event>

‎evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5156.map

+63-32
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,22 @@ Maps:
4545
-
4646
Name: ProcessID
4747
Value: "/Event/EventData/Data[@Name=\"ProcessID\"]"
48-
48+
-
49+
Property: PayloadData5
50+
PropertyValue: "Direction: %Direction%"
51+
Values:
52+
-
53+
Name: Direction
54+
Value: "/Event/EventData/Data[@Name=\"Direction\"]"
55+
Refine: "%%(.{5})"
56+
-
57+
Property: PayloadData6
58+
PropertyValue: "LayerName: %LayerName%"
59+
Values:
60+
-
61+
Name: LayerName
62+
Value: "/Event/EventData/Data[@Name=\"LayerName\"]"
63+
Refine: "%%(.{5})"
4964
Lookups:
5065
-
5166
Name: Protocol
@@ -66,42 +81,58 @@ Lookups:
6681
12: PARC Universal Packet Protocol (PUP)
6782
27: Reliable Datagram Protocol (RDP)
6883
46: Reservation Protocol (RSVP) QoS
84+
-
85+
Name: Direction
86+
Default: Unknown code
87+
Values:
88+
"%%14593": Outbound
89+
"%%14592": Inbound
90+
-
91+
Name: LayerName
92+
Default: Unknown code
93+
Values:
94+
"%%14597": Transport
95+
"%%14601": ICMP Error
96+
"%%14608": Resource Assignment
97+
"%%14609": Listen
98+
"%%14610": Receive/Accept
99+
"%%14611": Connect
69100

70101
# Documentation:
71102
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5156
72103
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
73104
#
74105
# Example Event Data:
75106
# <Event>
76-
# <System>
77-
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d" />
78-
# <EventID>5156</EventID>
79-
# <Version>1</Version>
80-
# <Level>0</Level>
81-
# <Task>12810</Task>
82-
# <Opcode>0</Opcode>
83-
# <Keywords>0x8020000000000000</Keywords>
84-
# <TimeCreated SystemTime="2019-03-19 23:35:08.7860165" />
85-
# <EventRecordID>452812</EventRecordID>
86-
# <Correlation />
87-
# <Execution ProcessID="4" ThreadID="60" />
88-
# <Channel>Security</Channel>
89-
# <Computer>PC01.example.corp</Computer>
90-
# <Security />
91-
# </System>
92-
# <EventData>
93-
# <Data Name="ProcessID">812</Data>
94-
# <Data Name="Application">\device\harddiskvolume1\windows\system32\svchost.exe</Data>
95-
# <Data Name="Direction">%%14593</Data>
96-
# <Data Name="SourceAddress">fe80::80ac:4126:fa58:1b81</Data>
97-
# <Data Name="SourcePort">546</Data>
98-
# <Data Name="DestAddress">ff02::1:2</Data>
99-
# <Data Name="DestPort">547</Data>
100-
# <Data Name="Protocol">17</Data>
101-
# <Data Name="FilterRTID">65853</Data>
102-
# <Data Name="LayerName">%%14611</Data>
103-
# <Data Name="LayerRTID">50</Data>
104-
# <Data Name="RemoteUserID">S-1-0-0</Data>
105-
# <Data Name="RemoteMachineID">S-1-0-0</Data>
106-
# </EventData>
107+
# <System>
108+
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d" />
109+
# <EventID>5156</EventID>
110+
# <Version>1</Version>
111+
# <Level>0</Level>
112+
# <Task>12810</Task>
113+
# <Opcode>0</Opcode>
114+
# <Keywords>0x8020000000000000</Keywords>
115+
# <TimeCreated SystemTime="2019-03-19 23:35:08.7860165" />
116+
# <EventRecordID>452812</EventRecordID>
117+
# <Correlation />
118+
# <Execution ProcessID="4" ThreadID="60" />
119+
# <Channel>Security</Channel>
120+
# <Computer>PC01.example.corp</Computer>
121+
# <Security />
122+
# </System>
123+
# <EventData>
124+
# <Data Name="ProcessID">812</Data>
125+
# <Data Name="Application">\device\harddiskvolume1\windows\system32\svchost.exe</Data>
126+
# <Data Name="Direction">%%14593</Data>
127+
# <Data Name="SourceAddress">fe80::80ac:4126:fa58:1b81</Data>
128+
# <Data Name="SourcePort">546</Data>
129+
# <Data Name="DestAddress">ff02::1:2</Data>
130+
# <Data Name="DestPort">547</Data>
131+
# <Data Name="Protocol">17</Data>
132+
# <Data Name="FilterRTID">65853</Data>
133+
# <Data Name="LayerName">%%14611</Data>
134+
# <Data Name="LayerRTID">50</Data>
135+
# <Data Name="RemoteUserID">S-1-0-0</Data>
136+
# <Data Name="RemoteMachineID">S-1-0-0</Data>
137+
# </EventData>
107138
# </Event>

0 commit comments

Comments
 (0)