detection.wiki

Microsoft-Windows-BfeTriggerProvider

EventTitleChannelSampleRule
1task_0Opcode_FirewallPortOpenEventOperationalNN
2task_0Opcode_FirewallPortCloseEventOperationalNN

Event ID 1: task_0Opcode_FirewallPortOpenEvent

#
Channel
Operational
Opcode
Opcode_FirewallPortOpenEvent

Fields #

NameDescription
FirewallPortStatusChangeGuid GUID

Event ID 2: task_0Opcode_FirewallPortCloseEvent

#
Channel
Operational
Opcode
Opcode_FirewallPortCloseEvent

Fields #

NameDescription
FirewallPortStatusChangeGuid GUID

Provenance

ETW provider GUID 54732ee5-61ca-4727-9da1-10be5a4f773d

Defined in fwpkclnt.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4647, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.6584, captured 2026-06-02 — Manifest XML pack, 2.0 MB