DFIRHub

Windows event log · Microsoft-Windows-TerminalServices-RDPClient/Operational1105 RDP the multi-transport connection has been disconnected

  • Remote access
  • 1 field
  • Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx
  • Microsoft-Windows-TerminalServices-ClientActiveXCore

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • PayloadData6ActivityID: %ActivityID%
    • %ActivityID% = /Event/System/Correlation/@ActivityID

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-ClientActiveXCore" Guid="28aa95bb-d444-4719-a36f-40462168127e"/>
    <EventID>1105</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>101</Task>
    <Opcode>10</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2022-02-07 20:55:05.6941087"/>
    <EventRecordID>5</EventRecordID>
    <Correlation ActivityID="b2a18fda-2606-46c1-9ab8-b4c86dd20000"/>
    <Execution ProcessID="7024" ThreadID="6964"/>
    <Channel>Microsoft-Windows-TerminalServices-RDPClient/Operational</Channel>
    <Computer>HOSTNAME</Computer>
    <Security UserID="S-1-5-21-1018296586-1262379815-4003437281-500"/>
  </System>
  <EventData></EventData>
</Event>

References

1 link

Source: evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1105.map(opens in new tab) by Gabriele Zambelli @gazambelli and contributors(opens in new tab), MIT License(opens in new tab)