Windows Firewall log
Host-level connection records, off by default, and the rule changes that accompany them. The rule additions are worth more than the connections.
where it lives
%SYSTEMROOT%\System32\LogFiles\Firewall\pfirewall.logOff by default, so its absence is the normal case.
Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtxEvents 2004 and 2005 record rules added and changed, and this channel is on by default.
what it proves
- Rules added or modified, with the rule detail, in the event channel
- The firewall profile being changed or turned off
- Allowed and dropped connections, with addresses and ports, where text logging was enabled
what it does not prove
- Anything about connections if text logging was never turned on, which is the default
- The process responsible. The text log records the connection, not the owner
- That a rule is benign because it looks like a product. Rule names are free text and are chosen to blend in
parsing it
Any text editorEvtxECmd (Eric Zimmerman)Get-NetFirewallRule
tampering and anti-forensics
Adding a permissive inbound rule is quieter than disabling the firewall and achieves the same thing for one port. Event 2004 catches it and very few teams watch that channel.
how long it survives
Text log is size-capped and rotates to a single .old file. The event channel follows its own cap.