Network & remote access
Windows Firewall Logs
Windows Firewall cheat sheet: pfirewall.log format and defaults, rule change events 2004-2006, WFP audit 5156/5157, rules in the registry and netsh abuse.
- Location
- C:\Windows\System32\LogFiles\Firewall\pfirewall.log
- Proves
- Allowed or dropped connections (if logging is on) and when firewall rules or profiles were changed
- Timestamps
- pfirewall.log date/time columns in local time; event logs in UTC (FILETIME precision)
- Retention
- pfirewall.log 4 MB by default, rolled once to pfirewall.log.old; event logs are circular
- Access
- Administrator; pfirewall.log is held open by the firewall service, raw copy may be needed
- Type
- File / file system
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- WindowsFirewallEventLogs
- Velociraptor
- Windows.Triage.Targets:WindowsFirewallEventLogs
Tools
Compare all tools- EVTX ParserIn browser
- PCAP ParserIn browser
- EvtxECmdCLI
- Get-WinEventCLI · built into Windows
- Log ParserCLI
- Registry ExplorerGUI
- VelociraptorPlatform · open source
What it is
Windows Defender Firewall (formerly Windows Firewall) leaves three kinds of evidence: a text packet log (pfirewall.log), event logs that record configuration changes, and Windows Filtering Platform (WFP) audit events in the Security log. The rule set itself is stored in the registry. Together they answer two questions: did this host talk to that address, and did someone open a hole in the firewall.
Location
| Evidence | Location | Default state |
|---|---|---|
| Packet log (XP SP2) | C:\Windows\pfirewall.log | Off |
| Packet log (Vista and later) | %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log | Off (per profile) |
| Firewall event log (Vista and later) | Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx | On |
| WFP audit | Security.evtx | Off (needs audit policy) |
| Local rules | HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | Present |
| GPO rules | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\FirewallRules | If a policy applies |
| Profile and logging settings | ...\FirewallPolicy\DomainProfile, StandardProfile, PublicProfile (and \Logging subkeys) | Present |
The log path can be changed per profile, so read LogFilePath before assuming the default.
What it proves
- pfirewall.log: a connection attempt was allowed (
ALLOW) or dropped (DROP), with IPs, ports and protocol. Thepathcolumn is the direction (SEND,RECEIVE), not a process path; some recent Windows 11 builds add apidcolumn, but do not count on it. - Firewall event log: a rule was added, modified or deleted, or a profile setting (for example firewall on/off) changed, and which application made the change.
- 5156/5157: the process (
Application) behind each permitted or blocked connection, which pfirewall.log generally lacks.
It does not prove data volume transferred (see SRUM) or anything about traffic when logging was disabled, which is the default.
Key fields
| Source | Field / ID | Meaning |
|---|---|---|
| pfirewall.log | date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path | W3C-style header (#Fields:), space separated |
| Firewall evtx | 2004 / 2005 / 2006 | Rule added / modified / deleted (rule name, application path, ports, modifying application) |
| Firewall evtx | 2033 | All rules deleted |
| Firewall evtx | 2003 | Profile setting changed (for example Enable Windows Defender Firewall) |
| Security | 5156 / 5157 | WFP permitted / blocked a connection (process, direction, IPs, ports) |
| Security | 5152 | WFP dropped a packet |
| Security | 4946 / 4947 / 4948 / 4950 | Rule added / modified / deleted, setting changed (MPSSVC rule-level audit) |
| Registry rule value | v2.xx|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=3389|App=...|Name=...| | One value per rule, keyed by rule GUID or name |
Recent Windows 11 builds log rule changes under newer IDs (2097 added, 2099 modified, 2052 deleted are commonly reported). Filter on both sets.
Timestamps
| Timestamp | Format | Pitfalls |
|---|---|---|
pfirewall.log date + time | YYYY-MM-DD HH:MM:SS, local time | No time zone in the file; convert using the host's TimeZoneInformation (UTC and local time) |
Event TimeCreated | UTC | Rule change time, not rule creation in the registry |
| Registry key last write | UTC | FirewallRules key time only shows the latest change to any rule |
Retention and clearing
pfirewall.logdefaults to 4,096 KB. When full, it is renamed topfirewall.log.old(overwriting the previous one) and a new file starts, so only about 8 MB of history ever exists.- The firewall event log and Security log are circular; Security volume explodes if 5156 is enabled.
- Attackers commonly disable the firewall or add allow rules:
netsh advfirewall set allprofiles state off,netsh advfirewall firewall add rule name="x" dir=in action=allow protocol=TCP localport=3389,Set-NetFirewallProfile -Enabled False, or the legacynetsh firewallcontext.
Collection
robocopy C:\Windows\System32\LogFiles\Firewall E:\case\Firewall /COPY:DAT
wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" E:\case\Firewall.evtx
reg export "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy" E:\case\FirewallPolicy.reg
netsh advfirewall show allprofiles
auditpol /get /subcategory:"Filtering Platform Connection"
KAPE WindowsFirewall collects the text logs; EventLogs covers the EVTX files. If the copy fails because the file is in use, use a raw copy (KAPE, Velociraptor or an image).
Parsing tools
- EvtxECmd, Get-WinEvent, Chainsaw: firewall and Security events.
- Log Parser or any CSV tool:
pfirewall.logis plain text; skip the#header lines. - Registry Explorer / RECmd: decode
FirewallRulesvalues and key times. - Velociraptor: live queries of rules and log files across hosts.
Investigation tips
- Hunt rule events where the modifying application is
netsh.exe,powershell.exeor an unknown binary, and rules opening RDP (3389), SMB (445), WinRM (5985/5986) or allowing a program in a user-writable path. - Compare
FirewallRulesagainst a clean build: rules with odd names,Active=TRUEinbound allows andApp=in\AppData\or\ProgramData\stand out. - A 2003 event turning the firewall off shortly before lateral movement is a strong anchor for the timeline.
- Correlate pfirewall.log
DROPbursts with 4625 logons to spot scanning and brute force. - Pair 5156 process names with Sysmon event 3 if both exist.
Related artifacts
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- Network profiles (NetworkList)NetworkList cheat sheet: network profiles, SSIDs, gateway MAC addresses, first and last connection times (local time), WLAN profile files and WLAN events.
- SRUM (System Resource Usage Monitor)SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.
- RDP connection artifactsRDP forensics cheat sheet: target-side event IDs (4624 type 10, 1149, 21–25, 131) and source-side traces (Terminal Server Client keys, Default.rdp, 1024).
- Sysmon Event LogSysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.
- Remote access tools (RMM)RMM and remote access tool cheat sheet: AnyDesk, TeamViewer, ScreenConnect and more, their log files, connection IDs, IPs and timestamps, and how to hunt abuse.
Glossary terms
- Windows event IDThe number identifying an event type within a given provider; it only has meaning when paired with its provider and log channel.
- Lateral movementAn attacker moving from one compromised host to others in the network, using RDP, SMB, PsExec, WMI, WinRM or remote tasks and services.
- Anti-forensicsTechniques used to destroy, hide or falsify evidence, such as log clearing, timestomping, wiping and deleting shadow copies or the USN journal.
- UTC vs local time in Windows artifactsWhy some Windows artifacts record UTC and others local time, and how the TimeZoneInformation registry key helps normalize a forensic timeline.
Guides
- Windows Event Log Forensics: EVTX, Event IDs and HuntingA practitioner guide to Windows event logs: EVTX format, key channels, Security and Sysmon event IDs, audit policy, cleared-log recovery and hunting tools.
- Lateral Movement Forensics: RDP, PsExec, WMI and WinRMMap source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
- Detecting Windows Anti-Forensics: What Survives the CleanupDetect log clearing, timestomping, secure deletion, VSS deletion and Defender tampering on Windows, mapped to MITRE ATT&CK, with the traces each one leaves.
- Remote Access Tool Forensics: AnyDesk, TeamViewer and MoreInvestigate abused RMM and remote access tools on Windows: install traces, per-tool logs, session IDs and IPs, file transfers and telling attackers from IT.