Data Source: Windows Event Log Security 5447

Date: 2026-08-23

ID: b94e3b5d-d00f-4fed-88e9-c8ea87495618

Author: Nasreddine Bencherchali, Splunk

Description

Logs Windows Filtering Platform runtime filter changes, including the change type, provider, filter, layer, conditions, and filter action metadata.

Details

Property	Value
Source	`XmlWinEventLog:Security`
Sourcetype	`XmlWinEventLog`
Separator	EventCode

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Filtering Platform Filter Added To Block EDR Process	Disable or Modify Tools	TTP
Windows EDRSilencer Custom Outbound Filter Added	Disable or Modify Tools	TTP

Supported Apps

Splunk Add-on for Microsoft Windows (version 11.0.2)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">Action</span>
  
  <span class="pill kill-chain">ActivityID</span>
  
  <span class="pill kill-chain">CalloutKey</span>
  
  <span class="pill kill-chain">CalloutName</span>
  
  <span class="pill kill-chain">ChangeType</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">Conditions</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">FilterId</span>
  
  <span class="pill kill-chain">FilterKey</span>
  
  <span class="pill kill-chain">FilterName</span>
  
  <span class="pill kill-chain">FilterType</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">LayerId</span>
  
  <span class="pill kill-chain">LayerKey</span>
  
  <span class="pill kill-chain">LayerName</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">ProcessId</span>
  
  <span class="pill kill-chain">ProviderKey</span>
  
  <span class="pill kill-chain">ProviderName</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">UserName</span>
  
  <span class="pill kill-chain">UserSid</span>
  
  <span class="pill kill-chain">Version</span>
  
  <span class="pill kill-chain">Weight</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">name</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">subject</span>
  
  <span class="pill kill-chain">ta_windows_action</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
</div>

Example Log

1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>5447</EventID><Version>0</Version><Level>0</Level><Task>13573</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2026-05-23T15:32:49.8857017Z'/><EventRecordID>153502136</EventRecordID><Correlation ActivityID='{a015d80e-e931-0006-0cd9-15a031e9dc01}'/><Execution ProcessID='1152' ThreadID='900'/><Channel>Security</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='ProcessId'>16824</Data><Data Name='UserSid'>S-1-5-21-3344543075-1022232225-2459664213-500</Data><Data Name='UserName'>ATTACKRANGE\Administrator</Data><Data Name='ProviderKey'>{a4b43ab7-75d5-4d88-a62c-8b5d2677c73d}</Data><Data Name='ProviderName'>Microsoft Corporation</Data><Data Name='ChangeType'>%%16384</Data><Data Name='FilterKey'>{da607736-f157-4bdd-9ad9-042516072b55}</Data><Data Name='FilterName'>Custom Outbound Filter</Data><Data Name='FilterType'>%%16387</Data><Data Name='FilterId'>305460</Data><Data Name='LayerKey'>{c38d57d1-05a7-4c33-904f-7fbceee60e82}</Data><Data Name='LayerName'>ALE Connect v4 Layer</Data><Data Name='LayerId'>48</Data><Data Name='Weight'>18446744073709551615</Data><Data Name='Conditions'>Condition ID: {d78e1e87-8644-4ea5-9437-d809ecefc971} Match value: Equal to Condition value: 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \.d.e.v.i.c.e.\. 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k. 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 33 00 5c 00 v.o.l.u.m.e.3.\. 00000030 70 00 72 00 6f 00 67 00-72 00 61 00 6d 00 64 00 p.r.o.g.r.a.m.d. 00000040 61 00 74 00 61 00 5c 00-6d 00 69 00 63 00 72 00 a.t.a.\.m.i.c.r. 00000050 6f 00 73 00 6f 00 66 00-74 00 5c 00 77 00 69 00 o.s.o.f.t.\.w.i. 00000060 6e 00 64 00 6f 00 77 00-73 00 20 00 64 00 65 00 n.d.o.w.s. .d.e. 00000070 66 00 65 00 6e 00 64 00-65 00 72 00 5c 00 70 00 f.e.n.d.e.r.\.p. 00000080 6c 00 61 00 74 00 66 00-6f 00 72 00 6d 00 5c 00 l.a.t.f.o.r.m.\. 00000090 34 00 2e 00 31 00 38 00-2e 00 32 00 36 00 30 00 4...1.8...2.6.0. 000000a0 34 00 30 00 2e 00 37 00-2d 00 30 00 5c 00 6d 00 4.0...7.-.0.\.m. 000000b0 73 00 6d 00 70 00 65 00-6e 00 67 00 2e 00 65 00 s.m.p.e.n.g...e. 000000c0 78 00 65 00 00 00 x.e...</Data><Data Name='Action'>%%16389</Data><Data Name='CalloutKey'>{00000000-0000-0000-0000-000000000000}</Data><Data Name='CalloutName'>-</Data></EventData></Event>

Required Output Fields

dest

Source: GitHub | Version: 1