win:security 5158
The Windows Filtering Platform has permitted a bind to a local port.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit Filtering Platform Connection
- Audit category
- Object Access
- Audit subcategory
- Audit Filtering Platform Connection
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
Microsoft audit baseline (dc); Microsoft audit baseline (server); Microsoft audit baseline (workstation)
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Recommended | Microsoft audit baseline (workstation) |
| Windows member server | Recommended | Microsoft audit baseline (server) |
| Windows domain controller | Recommended | Microsoft audit baseline (dc); Microsoft audit baseline (server) |
| Windows web server (IIS), internet-facing | Recommended | Microsoft audit baseline (server) |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: The Windows Filtering Platform has permitted a bind to a local port. |