security_content/data_sources/windows_event_log_remoteconnectionmanager_1149.yml at 2b6d541b4c179dc3fc0dbabcb420fb98ba1d5f88 · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: Windows Event Log RemoteConnectionManager 1149
id: 08f9edb4-f95f-40be-b1dd-bc3a1cd95aaf
version: 3
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs an event when a Remote Desktop Service session is initialized.
mitre_components:
    - Network Connection Creation
    - Logon Session Creation
    - Logon Session Metadata
source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
sourcetype: wineventlog
separator: EventCode
separator_value: '1149'
supported_TA:
    - name: Splunk Add-on for Microsoft Windows
      url: https://splunkbase.splunk.com/app/742
      version: 10.0.1
fields:
    - _time
    - ActivityID
    - Channel
    - Computer
    - EventCode
    - EventID
    - EventRecordID
    - Guid
    - Keywords
    - Level
    - Name
    - Opcode
    - ProcessID
    - RecordNumber
    - SystemTime
    - System_Props_Xml
    - Task
    - ThreadID
    - UserData_Xml
    - UserID
    - Version
    - dvc
    - dvc_nt_host
    - event_id
    - eventtype
    - host
    - id
    - index
    - linecount
    - punct
    - signature_id
    - source
    - sourcetype
    - splunk_server
    - tag
    - tag::eventtype
    - timestamp
    - user_id
    - vendor_product
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-TerminalServices-RemoteConnectionManager' Guid='{c76baa63-ae81-421c-b425-340b4b24157f}'/><EventID>1149</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x1000000000000000</Keywords><TimeCreated SystemTime='2024-04-11T00:54:59.678287300Z'/><EventRecordID>2064</EventRecordID><Correlation ActivityID='{f42005b9-c322-4bd9-962e-c985c22d0000}'/><Execution ProcessID='468' ThreadID='968'/><Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel><Computer>ar-win-1.attackrange.local</Computer><Security UserID='S-1-5-20'/></System><UserData><EventXML xmlns='Event_NS'><Param1>Administrator</Param1><Param2>ATTACKRANGE</Param2><Param3>10.0.1.14</Param3></EventXML></UserData></Event>