--- title: 5154(S) The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. (Windows 10) description: Describes security event 5154(S) The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: Mir0sh --- # 5154(S): The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. **Applies to** - Windows 10 - Windows Server 2016 Event 5154 illustration ***Subcategory:*** [Audit Filtering Platform Connection](audit-filtering-platform-connection.md) ***Event Description:*** This event generates every time [Windows Filtering Platform](https://msdn.microsoft.com/en-us/library/windows/desktop/aa366510(v=vs.85).aspx) permits an application or service to listen on a port. > **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
***Event XML:*** ``` - - 5154 0 0 12810 0 0x8020000000000000 287929 Security DC01.contoso.local - 4152 \\device\\harddiskvolume2\\documents\\listener.exe 0.0.0.0 4444 6 0 %%14609 40 ``` ***Required Server Roles:*** None. ***Minimum OS Version:*** Windows Server 2008, Windows Vista. ***Event Versions:*** 0. ***Field Descriptions:*** **Application Information**: - **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process which was permitted to listen on the port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): Task manager illustration If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager. You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**. - **Application Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process. Logical disk is displayed in format \\device\\harddiskvolume\#. You can get all local volume numbers by using **diskpart** utility. The command to get volume numbers using diskpart is “**list volume”**: DiskPart illustration **Network Information:** - **Source Address** \[Type = UnicodeString\]**:** local IP address on which application requested to listen on the port. - IPv4 Address - IPv6 Address - :: - all IP addresses in IPv6 format - 0.0.0.0 - all IP addresses in IPv4 format - 127.0.0.1 , ::1 - localhost - **Source Port** \[Type = UnicodeString\]: source TCP\\UDP port number which was requested for listening by application. - **Protocol** \[Type = UInt32\]: protocol number. For example: - 6 – TCP. - 17 – UDP. More information about possible values for this field: . **Filter Information:** - **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which allows application to listen on the specific port. By default Windows firewall won't prevent a port from being listened by an application and if this application doesn’t match any filters you will get value **0** in this field. To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As result of this command **filters.xml** file will be generated. You need to open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: Filters.xml file illustration - **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/en-us/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. - **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: Wfpstate xml illustration ## Security Monitoring Recommendations For 5154(S): The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. - If you have a “whitelist” of applications that are associated with certain operating systems or server roles, and that are expected to listen on specific ports, monitor this event for **“Application Name”** and other relevant information. - If a certain application is allowed to listen only on specific port numbers, monitor this event for **“Application Name”** and **“Network Information\\Source Port**.**”** - If a certain application is allowed to listen only on a specific IP address, monitor this event for **“Application Name”** and **“Network Information\\Source Address**.**”** - If a certain application is allowed to use only TCP or UDP protocols, monitor this event for **“Application Name”** and the protocol number in **“Network Information\\Protocol**.**”** - If you have a pre-defined application which should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. - You can monitor to see if “**Application**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). - If you have a pre-defined list of restricted substrings or words in application names (for example, “**mimikatz**” or “**cain.exe**”), check for these substrings in “**Application**.” - Typically this event has an informational purpose.