Windows Firewall Rule Logging

Network perimeter firewalls only see north-south traffic. Windows Defender Firewall logs provide crucial, localized visibility into east-west lateral movement, internal port scanning, and unauthorized outbound C2 (command-and-control) beaconing.

How to enable it. Do not rely on the legacy pfirewall.log text file. Modern SOCs track the Windows Filtering Platform (WFP) directly in the Windows Security event log. GPO path: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Object Access. Enable Audit Filtering Platform Connection (success and failure) and Audit Filtering Platform Packet Drop (failure).

Key event IDs and detection ideas:

• Event ID 5156 (WFP permitted connection) — maps internal lateral movement. Use case: establish a baseline of normal traffic, then alert when a workstation initiates an RDP (port 3389) or SMB (port 445) connection to another workstation. Workstations should generally talk to servers and domain controllers, not to each other.
• Event ID 5157 (WFP blocked connection) — a sudden, high volume of 5157 events from a single internal host is a massive red flag: a compromised machine performing an internal port scan (e.g., Nmap) or a worm spreading (like WannaCry).
• Event ID 5152 / 5153 (packet dropped / allowed by IPsec filter) — useful in highly segmented zero-trust environments.
• Event ID 2004 / 2005 (firewall rule added / modified) — detect malware or an attacker creating a persistent backdoor. Alert any time a rule is added that allows inbound traffic on non-standard ports (e.g., 4444, 8080), or that lets a suspicious executable (like cmd.exe) bypass the firewall.