Detection rules › By event

Microsoft-Windows-TerminalServices-RemoteConnectionManager

Event	Rules
Event ID 1149	4
Event ID 20503	1
Event ID 20504	1
Event ID 20508	1

Event ID 1149

4 detection rules reference this event. View event page.

Sigma (3)

RDP reconnaissance with valid credentials performed on multiple hosts severity high T1021, T1021.001, T1078
RDP tunneling detected severity high T1021, T1021.001, T1572
RDP tunneling via ngrok detected severity high T1021, T1021.001, T1572

Splunk (1)

Windows RDP Connection Successful T1563, T1563.002

Event ID 20503

1 detection rules reference this event. View event page.

Sigma (1)

RDP shadow session started (native) severity medium T1021, T1021.001, T1113, T1125

Event ID 20504

1 detection rules reference this event. View event page.

Sigma (1)

RDP shadow session started (native) severity medium T1021, T1021.001, T1113, T1125

Event ID 20508

1 detection rules reference this event. View event page.

Sigma (1)

RDP shadow session started (native) severity medium T1021, T1021.001, T1113, T1125