Destination System Artifacts - Quick Reference

Event Logs

Security Event Log – security.evtx

• 4624 Logon Type 10

  • Source IP/Logon User Name

• 4778/4779

  • IP Address of Source/Source System Name

  • Logon User Name

Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx

• 131 – Connection Attempts

  • Source IP

• 98 – Successful Connections

Microsoft-Windows-Terminal Services-RemoteConnection Manager%4Operational.evtx

• 1149

  • Source IP/Logon User Name

    • Blank user name may indicate use of Sticky Keys

Microsoft-Windows-Terminal Services-LocalSession Manager%4Operational.evtx

• 21, 22, 25

  • Source IP/Logon User Name

• 41

  • Logon User Name

Registry

ShimCache - System

• rdpclip.exe

• tstheme.exe

AmCache.hve - First Time Executed

• tstheme.exe

• rdpclip.exe

File System

Prefetch – C:\Windows\Prefetch

• rdpclip.exe-{hash}.pf

• tstheme.exe-{hash}.pf