windows rdp event ids - SERP Analysis

https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/

https://frsecure.com/blog/rdp-connection-event-logs/

https://www.socinvestigation.com/windows-rdp-event-ids-cheatsheet/

https://answers.microsoft.com/en-us/windows/forum/all/how-to-check-if-anyone-try-to-connect-to-my-pc-via/25f50abd-cebc-4022-81ac-e09cfc5e1518

https://www.aon.com/cyber-solutions/aon_cyber_labs/remote-desktop-event-log-analysis_variations-in-logging-for-event-id-1029/

https://systemweakness.com/windows-rdp-event-logs-identification-tracking-and-investigation-part-1-d1f23e26cc05

https://learn.microsoft.com/en-us/answers/questions/575295/remote-desktop-logoff-event-6734-in-windows-server

https://www.reddit.com/r/sysadmin/comments/uh1qkz/windows_event_log_ids_for_ssh_and_rdp_connections/

https://superuser.com/questions/409099/is-there-a-log-file-for-rdp-connections

https://www.thedfirspot.com/post/lateral-movement-remote-desktop-protocol-rdp-event-logs

https://shreenkhalabhattarai.medium.com/unraveling-rdp-events-understanding-remote-desktop-protocol-for-enhanced-security-78e6c1222bf

https://community.spiceworks.com/t/event-id-or-report-for-logon-events-in-remote-desktop/231673

https://www.anyviewer.com/how-to/windows-server-connection-logs-2578.html

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4778

https://jpcertcc.github.io/ToolAnalysisResultSheet/details/mstsc.htm

https://www.reddit.com/r/prtg/comments/vebyw7/rdp_event_log_monitoring/

https://andreafortuna.org/2020/06/04/windows-forensic-analysis-some-thoughts-on-rdp-related-event-ids/

https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/terminalservices_remoteconnectionmanager_operational_261/

https://www.youtube.com/watch?v=myzG11BP3Sk

https://howto.hyonix.com/article/track-analyze-remote-desktop-connection-logs-in-windows-server/

https://woshub.com/rdp-connection-logs-forensics-windows/

https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/

https://www.invictus-ir.com/news/top-5-windows-events-for-incident-response

https://nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/

https://help.duo.com/s/article/3658

https://docs.velociraptor.app/artifact_references/pages/windows.eventlogs.rdpauth/

https://www.youtube.com/watch?v=qxPoKNmnuIQ

https://github.com/mdecrevoisier/SIGMA-detection-rules/blob/main/windows-rdp/win-rdp-discovery%20performed%20on%20multiple%20hosts.yaml

https://www.gradenegger.eu/en/details-of-the-event-with-id-1063-of-the-source-microsoft-windows-terminal-services-remote-connection-manager/

https://community.spiceworks.com/t/remote-desktop-logon-failed-audit-events/305003

https://www.cybertriage.com/artifact/terminalservices_localsessionmanager_log/

https://nullsec.us/windows-event-id-1029-hashes/

https://support.sophos.com/support/s/article/KBA-000006797

https://www.magnetforensics.com/blog/rdp-artifacts-in-incident-response/

https://github.com/EricZimmerman/evtx/blob/master/evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1029.map

https://salt4n6.com/2019/09/22/event-id-1024/

https://www.manageengine.com/products/active-directory-audit/kb/windows-security-log-event-id-4624.html

https://docs.nxlog.co/integrate/windows-eventlog.html

https://community.splunk.com/t5/Splunk-Search/using-search-to-find-user-using-RDP-and-switch-identities-usage/td-p/538597

https://www.scribd.com/document/690374375/RDP-Event-Log-Forensics

https://99rdp.com/how-to-check-shutdown-logs-in-event-viewer-on-windows-server-2022/

https://13cubed.s3.amazonaws.com/downloads/rdp_flowchart.pdf

https://library.mosse-institute.com/articles/2022/06/threat-hunting-windows-event-logs/threat-hunting-windows-event-logs.html

https://serverfault.com/questions/694327/event-id-1158-remote-desktop-services-accepted-a-connection-from-ip-address-xx

https://kb.eventtracker.com/evtpass/evtPages/EventId_1136_Microsoft-Windows-ActiveDirectory_DomainService_67272.asp

https://community.cyberark.com/s/article/How-To-Troubleshoot-RDS-licensing-errors

https://www.hostitsmart.com/manage/knowledgebase/315/How-to-check-Reboot-and-Shutdown-logs-in-Windows-server.html

https://medium.com/%40laupeiip/tryhackme-windows-event-logs-write-up-e5b975f11c4c

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625

https://www.cozumpark.com/windows-rdp-event-log-hakkinda-her-sey/

https://insiderthreatmatrix.org/detections/DT024

https://support.oneidentity.com/one-identity-safeguard-for-privileged-sessions/kb/4292509/gathering-rdp-event-logs-from-windows-10-machines

https://rdpguard.com/rdp-exclusions-for-security-log-event-id-4625.aspx

https://zomro.com/blog/faq/277-how-to-view-rdp-connection-logs-in-windows-2016-2019

https://www.ninjaone.com/blog/how-to-read-windows-event-logs/

https://forensafe.com/blogs/windows_rdpevent.html

https://forensictalk.tistory.com/28

https://www.gradenegger.eu/en/details-of-the-event-with-id-1056-of-the-source-microsoft-windows-terminal-services-remote-connection-manager/

https://manage.accuwebhosting.com/knowledgebase/4215/How-Do-You-Check-Logs-for-Failed-RDP-Login-Attempts.html

https://www.websentra.com/windows-event-id-4776/

https://ponderthebits.com/

https://www.ired.team/offensive-security/enumeration-and-discovery/windows-event-ids-for-situational-awareness

https://www.activecountermeasures.com/hunting-windows-event-logs/

https://kb.eventtracker.com/evtpass/evtpages/EventId_304_Microsoft-Windows-TerminalServices-Gateway_67377.asp

https://help.duo.com/s/article/1438

https://www.anyviewer.com/how-to/session-has-been-disconnected-reason-code-0-2578.html

https://trunc.org/learning/brute-force-attacks-against-windows-remote-desktop

https://www.manageengine.com/products/active-directory-audit/kb/windows-security-log-event-id-4625.html

https://serverfault.com/questions/331858/unknown-and-strange-rdp-successful-logins-in-eventviewer

https://ikriv.com/blog/?p=2130

https://systemweakness.com/windows-rdp-event-logs-part-2-bbbc35898455

https://support.oneidentity.com/one-identity-safeguard-for-privileged-sessions/kb/4330122/gathering-rdp-event-logs-from-windows-clients-and-server-machines-10-server-2012-2016-2019-etc

https://www.youtube.com/watch?v=MSwZhhBko1M

https://www.codetwo.com/admins-blog/how-to-check-event-logs-with-powershell-get-eventlog/

https://salt4n6.com/tag/event-id-1024/

https://www.experts-exchange.com/questions/29239256/Please-wait-screen-issue-during-RDP.html

https://www.anoopcnair.com/wvd-event-logs-rdp-listener-tcp-reverse-connect-windows-10/

https://www.nccgroup.com/us/research-blog/detecting-and-protecting-when-remote-desktop-protocol-rdp-is-open-to-the-internet/

https://forwarddefense.com/media/attachments/2021/05/15/windows-event-log-analyst-reference.pdf

https://codelabsacademy.com/ky/learning-hub/interviews/details/rdp-logon-detection-in-event-logs/

https://www.linkedin.com/posts/deependra-chauhan-55a696141_important-window-events-for-soc-analyst-activity-7276150427547574272-cAf-

https://research.splunk.com/endpoint/ceaed840-56b3-4a70-b8e1-d762b1c5c08c/

https://www.techtarget.com/searchwindowsserver/tutorial/Query-event-logs-with-PowerShell-to-find-malicious-activity

https://community.citrix.com/forums/topic/235996-windows-server-2012-r2-remote-desktop-services-rdp-client-gets-black-screen-system-event-id-4005-terminalservices-event-id-36/

https://www.rapid7.com/blog/post/2019/06/05/microsoft-windows-rdp-network-level-authentication-bypass-cve-2019-9510-what-you-need-to-know/

https://www.beyondtrust.com/blog/entry/windows-server-events-monitor

https://zomro.com/blog/faq/258-kak-posmotret-logi-shutdown-i-restart-v-windows-server

https://www.youtube.com/watch?v=SWt23NfSC-s

https://systemcenterdiary.wordpress.com/2019/03/13/event-id-1306-from-source-terminalservices-sessionbroker-client/

https://www.elevenforum.com/t/windows-11-events-could-it-be-a-virus.12308/

https://forum.devolutions.net/topics/27377/rdp-via-connection-broker-doesnt-work-when-session-is-embedded

https://purerds.org/remote-desktop-security/auditing-remote-desktop-services-logon-failures-1/

https://help.hostinghome.in/knowledge-base/how-to-find-remote-desktop-last-login-ip-address-details/

https://www.linkedin.com/pulse/investigating-windows-event-id-4625-account-failed-log-marcus-burkert-449ue

https://port139.hatenablog.com/entry/2019/03/23/091740

https://manage.accuwebhosting.com/knowledgebase/3897/How-to-check-shutdown-and-reboot-logs-in-Windows-servers.html

https://www.tenforums.com/general-support/178417-how-handle-event-105-error.html

https://stackoverflow.com/questions/69298244/tracking-the-entire-history-of-rdp-sessions

https://terminal273.rssing.com/chan-12065603/all_p322.html

https://graylog.org/post/critical-windows-event-ids-to-monitor/