Event Viewer: Event ID 5157 "The Windows Filtering Platform has blocked a connection"

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          2026-07-28 10:52:17 AM
Event ID:      5157
Task Category: Filtering Platform Connection
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      Airfla
Description:
The Windows Filtering Platform has blocked a connection.

 Application Information:
              Process ID:                            2948
              Application Name:              \device\harddiskvolume3\windows\system32\svchost.exe

Network Information
              Direction:                            Inbound
              Source Address:                            192.168.1.254
              Source Port:                            5355
              Destination Address:              224.0.0.252
              Destination Port:                            5355
              Protocol:                            17
              Interface Index:                            10

 Filter Information:
              Filter Origin:                            QueryUser Default
              Filter Run-Time ID:              71916
              Layer Name:                            Receive/Accept
              Layer Run-Time ID:              44
              Remote User ID:                     NULLSID
              Remote Machine ID:              NULLSID
              Original Profile:                            Private
              Current Profile:                            Private
              Is Loopback:                            False
              Has Remote Dynamic Keyword Address:                            False
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <EventID>5157</EventID>
    <Version>3</Version>
    <Level>0</Level>
    <Task>12810</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2026-07-28T17:52:17.1169818Z" />
    <EventRecordID>19830063</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="296" />
    <Channel>Security</Channel>
    <Computer>Airfla</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ProcessID">2948</Data>
    <Data Name="Application">\device\harddiskvolume3\windows\system32\svchost.exe</Data>
    <Data Name="Direction">%%14592</Data>
    <Data Name="SourceAddress">192.168.1.254</Data>
    <Data Name="SourcePort">5355</Data>
    <Data Name="DestAddress">224.0.0.252</Data>
    <Data Name="DestPort">5355</Data>
    <Data Name="Protocol">17</Data>
    <Data Name="InterfaceIndex">10</Data>
    <Data Name="FilterOrigin">Query User Default</Data>
    <Data Name="FilterRTID">71916</Data>
    <Data Name="LayerName">%%14610</Data>
    <Data Name="LayerRTID">44</Data>
    <Data Name="RemoteUserID">S-1-0-0</Data>
    <Data Name="RemoteMachineID">S-1-0-0</Data>
    <Data Name="OriginalProfile">%%14645</Data>
    <Data Name="CurrentProfile">%%14645</Data>
    <Data Name="IsLoopback">%%1826</Data>
    <Data Name="HasRemoteDynamicKeywordAddress">%%1826</Data>
  </EventData>
</Event>