windows rdp event ids - SERP Analysis

https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/

https://frsecure.com/blog/rdp-connection-event-logs/

https://www.socinvestigation.com/windows-rdp-event-ids-cheatsheet/

https://answers.microsoft.com/en-us/windows/forum/all/how-to-check-if-anyone-try-to-connect-to-my-pc-via/25f50abd-cebc-4022-81ac-e09cfc5e1518

https://systemweakness.com/windows-rdp-event-logs-identification-tracking-and-investigation-part-1-d1f23e26cc05

https://superuser.com/questions/409099/is-there-a-log-file-for-rdp-connections

https://www.aon.com/cyber-solutions/aon_cyber_labs/remote-desktop-event-log-analysis_variations-in-logging-for-event-id-1029/

https://learn.microsoft.com/en-us/answers/questions/575295/remote-desktop-logoff-event-6734-in-windows-server

https://www.reddit.com/r/sysadmin/comments/uh1qkz/windows_event_log_ids_for_ssh_and_rdp_connections/

https://www.thedfirspot.com/post/lateral-movement-remote-desktop-protocol-rdp-event-logs

https://shreenkhalabhattarai.medium.com/unraveling-rdp-events-understanding-remote-desktop-protocol-for-enhanced-security-78e6c1222bf

https://community.spiceworks.com/t/event-id-or-report-for-logon-events-in-remote-desktop/231673

https://www.anyviewer.com/how-to/windows-server-connection-logs-2578.html

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4779

https://jpcertcc.github.io/ToolAnalysisResultSheet/details/mstsc.htm

https://community.spiceworks.com/t/remote-desktop-logon-failed-audit-events/305003

https://andreafortuna.org/2020/06/04/windows-forensic-analysis-some-thoughts-on-rdp-related-event-ids/

https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/terminalservices_remoteconnectionmanager_operational_261/

https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/

https://www.youtube.com/watch?v=myzG11BP3Sk

https://howto.hyonix.com/article/track-analyze-remote-desktop-connection-logs-in-windows-server/

https://woshub.com/rdp-connection-logs-forensics-windows/

https://www.aon.com/en/insights/cyber-labs/remote-desktop-event-log-analysis-variations-in-logging-for-event-id-1029

https://nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/

https://help.duo.com/s/article/3658

https://www.youtube.com/watch?v=qxPoKNmnuIQ

https://docs.velociraptor.app/artifact_references/pages/windows.eventlogs.rdpauth/

https://github.com/mdecrevoisier/SIGMA-detection-rules/blob/main/windows-rdp/win-rdp-discovery%20performed%20on%20multiple%20hosts.yaml

https://www.cybertriage.com/artifact/terminalservices_localsessionmanager_log/

https://www.gradenegger.eu/en/details-of-the-event-with-id-1063-of-the-source-microsoft-windows-terminal-services-remote-connection-manager/

https://salt4n6.com/2019/09/22/event-id-1024/

https://support.sophos.com/support/s/article/KBA-000006797

https://www.magnetforensics.com/blog/rdp-artifacts-in-incident-response/

https://rootguard.gitbook.io/cyberops/learning-resources/dfir/windows-forensics/window-artifact-analysis/user-activity-tracking-event-logs

https://www.manageengine.com/products/active-directory-audit/kb/windows-security-log-event-id-4624.html

https://docs.nxlog.co/integrate/windows-eventlog.html

https://insanecyber.com/windows-event-id-4624/

https://www.reddit.com/r/sysadmin/comments/1j87g11/three_users_are_getting_forcibly_signed_out_of/

https://community.splunk.com/t5/Splunk-Search/using-search-to-find-user-using-RDP-and-switch-identities-usage/td-p/538597

https://www.scribd.com/document/690374375/RDP-Event-Log-Forensics

https://www.linkedin.com/posts/krishan199438_105-windows-event-ids-for-siem-monitoring-activity-7275588714012033024-bXaz

https://github.com/logpresso/community/blob/main/contents/004_How_to_analyze_Windows_Event_Logs.md

https://99rdp.com/how-to-check-shutdown-logs-in-event-viewer-on-windows-server-2022/

https://serverfault.com/questions/694327/event-id-1158-remote-desktop-services-accepted-a-connection-from-ip-address-xx

https://13cubed.s3.amazonaws.com/downloads/rdp_flowchart.pdf

https://library.mosse-institute.com/articles/2022/06/threat-hunting-windows-event-logs/threat-hunting-windows-event-logs.html

https://kb.eventtracker.com/evtpass/evtpages/EventId_201_Microsoft-Windows-TerminalServices-Gateway_67388.asp

https://community.cyberark.com/s/article/How-To-Troubleshoot-RDS-licensing-errors

https://www.hostitsmart.com/manage/knowledgebase/315/How-to-check-Reboot-and-Shutdown-logs-in-Windows-server.html

https://medium.com/%40laupeiip/tryhackme-windows-event-logs-write-up-e5b975f11c4c

https://support.oneidentity.com/one-identity-safeguard-for-privileged-sessions/kb/4292509/gathering-rdp-event-logs-from-windows-10-machines

https://manage.accuwebhosting.com/knowledgebase/4215/How-Do-You-Check-Logs-for-Failed-RDP-Login-Attempts.html

https://www.cozumpark.com/windows-rdp-event-log-hakkinda-her-sey/

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625

https://zomro.com/blog/faq/277-how-to-view-rdp-connection-logs-in-windows-2016-2019

https://www.ninjaone.com/blog/how-to-read-windows-event-logs/

https://forensafe.com/blogs/windows_rdpevent.html

https://www.gradenegger.eu/en/details-of-the-event-with-id-1056-of-the-source-microsoft-windows-terminal-services-remote-connection-manager/

https://ponderthebits.com/

https://trunc.org/learning/brute-force-attacks-against-windows-remote-desktop

https://www.activecountermeasures.com/hunting-windows-event-logs/

https://ikriv.com/blog/?p=2130

https://kb.eventtracker.com/evtpass/evtpages/EventId_1004_Microsoft-Windows-TerminalServices-RemoteConnectio_67313.asp

https://www.ired.team/offensive-security/enumeration-and-discovery/windows-event-ids-for-situational-awareness

https://help.duo.com/s/article/1438

https://www.websentra.com/windows-event-id-4776/

https://www.anyviewer.com/how-to/view-connection-history-remote-desktop-windows-10-2578.html

https://www.manageengine.com/products/active-directory-audit/kb/windows-security-log-event-id-4625.html

https://forums.overclockers.co.uk/threads/windows-11-events-is-it-virus.18966797/

https://serverfault.com/questions/1048699/track-ip-adress-login-rdp-when-shutdown-happen

https://systemweakness.com/windows-rdp-event-logs-part-2-bbbc35898455

https://www.youtube.com/watch?v=MSwZhhBko1M

https://graylog.org/post/critical-windows-event-ids-to-monitor/

https://www.nccgroup.com/us/research-blog/detecting-and-protecting-when-remote-desktop-protocol-rdp-is-open-to-the-internet/

https://www.rapid7.com/blog/post/2019/06/05/microsoft-windows-rdp-network-level-authentication-bypass-cve-2019-9510-what-you-need-to-know/

https://forwarddefense.com/media/attachments/2021/05/15/windows-event-log-analyst-reference.pdf

https://codelabsacademy.com/ky/learning-hub/interviews/details/rdp-logon-detection-in-event-logs/

https://community.citrix.com/forums/topic/235996-windows-server-2012-r2-remote-desktop-services-rdp-client-gets-black-screen-system-event-id-4005-terminalservices-event-id-36/

https://nullsec.us/windows-event-id-1029-hashes/

https://www.coursehero.com/file/84193555/rdp-flowchartpdf/

https://forums.malwarebytes.com/topic/109146-terminalservices-remoteconnectionmanager-event-id-1057-the-relevant-status-code-was-object-already-exists/

https://expel.com/blog/mdr-insights-tracking-lateral-movement-of-bad-actors-in-a-windows-environment-part-i/

https://www.beyondtrust.com/blog/entry/windows-server-events-monitor

https://www.youtube.com/watch?v=SWt23NfSC-s

https://jumpcloud.com/support/use-logs-to-troubleshoot-user-lockouts-on-windows-devices

https://systemcenterdiary.wordpress.com/2019/03/13/event-id-1306-from-source-terminalservices-sessionbroker-client/

https://1286158324-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MO79pt4NiZPFhlGCglR%2Fuploads%2Fjf7Sw5vieeT2M6bRt4w2%2FRDP_DFIR.pdf?alt=media&token=55b6337c-2a18-43de-8761-73dda2b5c222

https://www.elevenforum.com/t/windows-11-events-could-it-be-a-virus.12308/

https://purerds.org/remote-desktop-security/auditing-remote-desktop-services-logon-failures-1/

https://forum.devolutions.net/topics/27377/rdp-via-connection-broker-doesnt-work-when-session-is-embedded

https://port139.hatenablog.com/entry/2019/05/03/162705

https://www.tenforums.com/general-support/178417-how-handle-event-105-error.html

https://stackoverflow.com/questions/69298244/tracking-the-entire-history-of-rdp-sessions

https://forensictalk.tistory.com/28

https://www.anoopcnair.com/wvd-event-logs-rdp-listener-tcp-reverse-connect-windows-10/

https://terminal273.rssing.com/chan-12065603/all_p322.html

https://insiderthreatmatrix.org/detections/DT024

https://www.youtube.com/watch?v=kf8xGlZP_ds&pp=0gcJCdgAo7VqN5tD

https://www.invictus-ir.com/news/top-5-windows-events-for-incident-response

https://specopssoft.com/blog/troubleshooting-group-policy-events/