The Windows Filtering Platform has detected a DoS attack
The Windows Filtering Platform (`WFP`) detected and dropped network packets exceeding Denial of Service thresholds.
Event ID 5148 triggers when the Windows Filtering Platform kernel engine detects packet rates, TCP SYN floods, or malformed connection bursts that trigger built-in DoS protection rules (`WFP DoS filter`).
Failure Reason / Root Cause:
High-volume network flood or malformed traffic triggering WFP DoS defense thresholds.
Raw Event XML snippet
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5148</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-07-17T09:54:44.936Z" />
<EventRecordID>1048576</EventRecordID>
<Correlation />
<Execution ProcessID="612" ThreadID="1024" />
<Channel>Security</Channel>
<Computer>DC01.enterprise.internal</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">SYSTEM</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<!-- Event telemetry fields specific to The Windows Filtering Platform has detected a DoS attack -->
</EventData>
</Event>MITRE ATT&CK mapping
| ID | Technique | Tactic |
|---|---|---|
T1498 | Network Denial of Service | Impact |
Recommended actions
- Inspect the `Source Address` and `Source Port`. If external, verify upstream firewall rate limiting; if internal, isolate the offending endpoint for malware infection or port scanning activity.