EventLogs-RDP
Collect Win7+ RDP related Event logs
- 12 paths
- Version 1.1
- Mark Hallman, esecrpm
Paths on disk
12 paths
Notes
v1.1
Including additional event logs for RDP events specified on SANS Hunt Evil ("Blue") poster
Source
Security.evtx
Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx
Destination
Security.evtx
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx
Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
References
7 links
- medium.com/@lucideus/introduction-to-event-log-analysis-part-1-windows-forensics-manual-2018-b936a1a35d8a(opens in new tab)
- medium.com/@lucideus/event-log-analysis-part-2-windows-forensics-manual-2018-75710851e323(opens in new tab)
- digitalforensics.com/blog/forensic-analysis-of-windows-event-logs-windows-files-activities-audit/(opens in new tab)
- youtu.be/Xw536W7kbDQ(opens in new tab)
- youtube.com/watch?v=myzG11BP3Sk(opens in new tab)
- sans.org/posters/?focus-area=digital-forensics(opens in new tab)
- sans.org/posters/hunt-evil/(opens in new tab)