Windows Event ID 5156 – Microsoft-Windows-Security-Auditing: Network Connection Allowed by Windows Filtering Platform

Start by examining the specific connection details in Event Viewer to understand what triggered the allowed connection.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log for Event ID 5156 by right-clicking Security → Filter Current Log
4. Enter 5156 in the Event IDs field and click OK
5. Double-click on a recent Event ID 5156 entry to view detailed information
6. Review key fields in the event details:
   • Process Information: Shows the executable path and process ID
   • Network Information: Contains source/destination IPs and ports
   • Filter Information: Displays the firewall rule that allowed the connection

Use PowerShell to efficiently query and analyze Event ID 5156 entries for patterns and anomalies.

1. Open PowerShell as Administrator
2. Query recent Event ID 5156 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific process or application:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} | Where-Object {$_.Message -like '*chrome.exe*'} | Select-Object TimeCreated, Message

4. Analyze connection patterns by destination port:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} -MaxEvents 1000 | ForEach-Object {if($_.Message -match 'Destination Port:\s+(\d+)'){$matches[1]}} | Group-Object | Sort-Object Count -Descending

5. Export events to CSV for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} -MaxEvents 500 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\temp\Event5156_Analysis.csv" -NoTypeInformation

Manage the generation of Event ID 5156 by configuring Windows audit policies for filtering platform connections.

1. Open Local Group Policy Editor by pressing Win + R, typing gpedit.msc, and pressing Enter
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Object Access
3. Double-click Audit Filtering Platform Connection
4. Configure the policy based on your monitoring requirements:
   • Check Success to log allowed connections (Event ID 5156)
   • Check Failure to log blocked connections (Event ID 5157)
   • Uncheck both to disable connection auditing
5. Click OK and run gpupdate /force to apply changes immediately
6. Alternatively, use auditpol command line:

   # Enable success auditing for filtering platform connections
   auditpol /set /subcategory:"Filtering Platform Connection" /success:enable
   
   # Disable all filtering platform connection auditing
   auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable

Perform advanced analysis of Event ID 5156 data to identify security patterns and potential threats.

1. Create a PowerShell script to analyze connection patterns:

   # Analyze Event ID 5156 for security patterns
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} -MaxEvents 2000
   
   # Extract connection details
   $Connections = foreach ($Event in $Events) {
       if ($Event.Message -match 'Process Name:\s+(.+?)\r\n.*Source Address:\s+([\d\.]+).*Destination Address:\s+([\d\.]+).*Destination Port:\s+(\d+)') {
           [PSCustomObject]@{
               TimeCreated = $Event.TimeCreated
               ProcessName = $matches[1]
               SourceIP = $matches[2]
               DestinationIP = $matches[3]
               DestinationPort = $matches[4]
           }
       }
   }
   
   # Identify top processes by connection count
   $Connections | Group-Object ProcessName | Sort-Object Count -Descending | Select-Object Name, Count

2. Identify unusual outbound connections:

   # Find connections to external IPs (not RFC 1918 private ranges)
   $ExternalConnections = $Connections | Where-Object {
       $_.DestinationIP -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
   }
   
   $ExternalConnections | Group-Object DestinationIP | Sort-Object Count -Descending

3. Monitor for suspicious process behavior:

   # Look for processes connecting to multiple external destinations
   $SuspiciousProcesses = $ExternalConnections | Group-Object ProcessName | Where-Object {$_.Count -gt 10}
   $SuspiciousProcesses | ForEach-Object {Write-Host "$($_.Name): $($_.Count) external connections" -ForegroundColor Yellow}

4. Set up automated monitoring with scheduled tasks or monitoring solutions

Configure enterprise-level monitoring and analysis of Event ID 5156 for comprehensive network security visibility.

1. Configure Windows Event Forwarding to centralize Event ID 5156 collection:

   # Create custom event subscription XML
   $SubscriptionXML = @"
   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>NetworkConnections</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Forward Event ID 5156 network connections</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <Query><![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=5156]]</Select>
               </Query>
           </QueryList>
       ]]></Query>
   </Subscription>
   "@
   
   # Save and create subscription
   $SubscriptionXML | Out-File -FilePath "C:\temp\NetworkConnections.xml"
   wecutil cs "C:\temp\NetworkConnections.xml"

2. Configure log parsing rules in your SIEM solution to extract key fields from Event ID 5156
3. Create correlation rules to detect:
   • Unusual connection patterns
   • Connections from unauthorized processes
   • High-volume data transfers
   • Connections to known malicious IP addresses
4. Set up automated alerting for suspicious network activity patterns
5. Implement log retention policies to balance storage costs with compliance requirements
6. Use PowerShell to create custom dashboards:

   # Generate daily network connection summary
   $Today = Get-Date -Format "yyyy-MM-dd"
   $TodayEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156; StartTime=(Get-Date).Date}
   
   Write-Host "Network Connection Summary for $Today" -ForegroundColor Green
   Write-Host "Total Connections: $($TodayEvents.Count)"
   Write-Host "Unique Processes: $(($TodayEvents | ForEach-Object {if($_.Message -match 'Process Name:\s+(.+?)\r\n'){$matches[1]}} | Sort-Object -Unique).Count)"
   Write-Host "Peak Hour: $(($TodayEvents | Group-Object {$_.TimeCreated.Hour} | Sort-Object Count -Descending | Select-Object -First 1).Name):00"