Event ID 5450

A Windows Filtering Platform sub-layer has been changed.

A Windows Filtering Platform sub-layer has been changed.

Subject:
    Security ID:        %2
    Account Name:       %3

Process Information:
    Process ID: %1

Provider Information:
    Provider ID:    %4
    Provider Name:  %5

Change Information:
    Change Type:    %6

Sub-layer Information:
    Sub-layer ID:   %7
    Sub-layer Name: %8
    Sub-layer Type: %9

Additional Information:
    Weight: %10


Event 5450 is logged whenever a WFP sub-layer is added or deleted while the system is running — with full subject context identifying the responsible account and process.

Auditing:     Conditional

Recommended for environments that need to detect: Unexpected persistent sub-layer registrations from unsigned or unknown kernel drivers. Security software tampering. Rootkit or implant activity establishing a new WFP filter bucket for long-term network interception.


Volume:     Low

Expect isolated events only when WFP-aware software (firewall, VPN, EDR) is installed, updated, or removed. On a stable, fully-provisioned system this event may not appear at all for weeks or months at a time.




Name Field Insertion String OS Example
Process ID ProcessId %1 Any 4
Security ID UserSid %2 Any S-1-5-18
Account Name UserName %3 Any NT AUTHORITY\SYSTEM
Provider ID ProviderKey %4 Any {4B153735-1049-...}
Provider Name ProviderName %5 Any Windows Firewall
Change Type ChangeType %6 Any %%385
Sub-layer ID SubLayerKey %7 Any {B3CDD441-AF90-...}
Sub-layer Name SubLayerName %8 Any Windows Firewall
Sub-layer Type SubLayerType %9 Any %%388


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Filtering Platform Policy Change"



LEFT/RIGHT arrow keys for navigation

Back to List