SOC Event Lookup
Event ID 5035FirewallP2

Windows Event ID 5035: The Windows Firewall Driver failed to start

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 5035 records that the Windows Firewall Driver failed to start or unexpectedly terminated.

Technical Metadata

Technical metadata for Event ID 5035
Event ID5035
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Failure
MITRE ATT&CKTA0005 Defense Evasion / T1562.004 Impair Defenses: Disable or Modify System Firewall
Key fields to watchError Code, Computer, EventID

Trigger Scenarios

Windows logs this event when the Windows Firewall driver fails to start or unexpectedly terminates and includes an Error Code in the message text.

Key Fields

Error Code

The Microsoft schema exposes Error Code:%1 as the concrete driver-failure reason. Preserve the exact value from the event.

Computer

Identifies the host where packet filtering may be impaired before or during service startup.

EventID

Event 5035 is firewall-driver specific; correlate it with 5030 for service failure and boot/service events.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 5035
SecurityEvent
| where EventID == 5035
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 5035
index=wineventlog source="WinEventLog:Security" EventCode=5035
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 5035
dataset = microsoft_windows_raw
| filter edr_event_id = 5035
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5035
title: Windows Security Event ID 5035
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5035
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1562.004Impair Defenses: Disable or Modify System Firewall

Detection Notes

T1562.004 Disable or Modify System Firewall is supported when threshold=1 Event 5035 follows unauthorized driver, service, or firewall-policy modification. Retain the rendered ErrorCode from Error Code:%1 and correlate 5030, 5038, boot-time driver telemetry, and change records; no universal numeric error code is defined by the event reference.

Common False Positives

  • Microsoft notes software or operating-system issues can cause this event.
  • Driver corruption or dependency failures during maintenance can create non-malicious failures.

Related Events

Sample Log

Sanitized event sample
EventID: 5035
Computer: HOST01
Error Code: 5

Frequently Asked Questions

What does Windows Event ID 5035 mean?

Event ID 5035 records that the Windows Firewall driver failed to start and includes a rendered error code.

Why is a firewall-driver failure high impact?

The driver enforces network filtering below the service layer, so failure can reduce host firewall protection even when caused by a nonmalicious system problem.

Which telemetry should be correlated with 5035?

Review 5030, driver and code-integrity events, service configuration, boot diagnostics, and recent security-product or operating-system changes.

Sources