Detection rules › Splunk
Windows RDP Connection Successful
The following analytic detects successful Remote Desktop Protocol (RDP) connections by monitoring EventCode 1149 from the Windows TerminalServices RemoteConnectionManager Operational log. This detection is significant as successful RDP connections can indicate remote access to a system, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. Monitoring successful RDP connections is crucial for identifying potential security breaches and mitigating risks promptly.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1563.002 Remote Service Session Hijacking: RDP Hijacking |
Event coverage
| Provider | Event | Title |
|---|---|---|
| TerminalServices-RemoteConnectionManager | Event ID 1149 | Remote Desktop Services: User authentication succeeded. |
Rule body splunk
name: Windows RDP Connection Successful
id: ceaed840-56b3-4a70-b8e1-d762b1c5c08c
version: 11
creation_date: '2023-04-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects successful Remote Desktop Protocol (RDP) connections by monitoring EventCode 1149 from the Windows TerminalServices RemoteConnectionManager Operational log. This detection is significant as successful RDP connections can indicate remote access to a system, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. Monitoring successful RDP connections is crucial for identifying potential security breaches and mitigating risks promptly.
data_source:
- Windows Event Log RemoteConnectionManager 1149
search: |-
`remoteconnectionmanager` EventCode=1149
| stats count min(_time) as firstTime max(_time) as lastTime
BY Computer, user_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| rename Computer as dest
| `windows_rdp_connection_successful_filter`
how_to_implement: The following analyic requires the WIndows TerminalServices RemoteConnectionManager Operational log to be enabled and ingested into Splunk. For the inputs, review https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706.
known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
references:
- https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706
- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
analytic_story:
- Active Directory Lateral Movement
- BlackByte Ransomware
- Windows RDP Artifacts and Defense Evasion
- Interlock Ransomware
- NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
- T1563.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/windows-xml.log
source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
sourcetype: XmlWinEventLog
test_type: unit
Stages and Predicates
Stage 1: search
`remoteconnectionmanager` EventCode=1149
Stage 2: stats
| stats count min(_time) as firstTime max(_time) as lastTime
BY Computer, user_id
Stage 3: search
| `security_content_ctime(firstTime)`
Stage 4: search
| `security_content_ctime(lastTime)`
Stage 5: rename
| rename Computer as dest
Stage 6: search
| `windows_rdp_connection_successful_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|