> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage/rdp/destination-system-artifacts-quick-reference.md).

# Destination System Artifacts - Quick Reference

{% tabs %}
{% tab title="Event Logs" %}
**Security Event Log – security.evtx** 

* [<mark style="color:blue;">**4624**</mark>](/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success.md) Logon Type 10&#x20;
  * Source IP/Logon User Name&#x20;
* [<mark style="color:blue;">**4778**</mark>](https://system32.eventsentry.com/security/event/4778)/[<mark style="color:blue;">**4779**</mark> ](https://system32.eventsentry.com/security/event/4779)
  * IP Address of Source/Source System Name&#x20;
  * Logon User Name&#x20;

**Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx**

* **131** – Connection Attempts
  * Source IP
* **98** – Successful Connections

**Microsoft-Windows-Terminal Services-RemoteConnection Manager%4Operational.evtx**

* 1149
  * Source IP/Logon User Name&#x20;
    * Blank user name may indicate use of Sticky Keys

**Microsoft-Windows-Terminal Services-LocalSession Manager%4Operational.evtx**

* 21, 22, 25&#x20;
  * Source IP/Logon User Name
* 41
  * Logon User Name
    {% endtab %}

{% tab title="Registry" %}
ShimCache - System

* rdpclip.exe
* tstheme.exe

AmCache.hve - First Time Executed

* tstheme.exe
* rdpclip.exe
  {% endtab %}

{% tab title="File System" %}
[Prefetch ](/windows-artifacts/program-execution/prefetch.md)– C:\Windows\Prefetch

* rdpclip.exe-{hash}.pf&#x20;
* tstheme.exe-{hash}.pf
  {% endtab %}
  {% endtabs %}