[Osquery_manager] RDP artifact saved query

[tomsonpl]

RDP Authentication Events

Comprehensive Remote Desktop Protocol (RDP) authentication and session tracking query for Windows forensic analysis. This query provides complete visibility into RDP activity by monitoring four distinct Windows event log channels, enabling detection of lateral movement, unauthorized access attempts, and session hijacking.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	RDP Authentication	✅	Windows	rdp_authentication_windows_elastic	d8d79510	RDP logon/logoff events, session tracking, and lateral movement detection

Queries by Platform

---

🪟 Windows - RDP Authentication and Session Tracking

Description

Monitors Windows Event Logs across four channels to provide comprehensive RDP session visibility. Captures successful and failed authentication attempts, session connections/disconnections, and session lifecycle events critical for detecting lateral movement and unauthorized remote access.

Detection Focus:

• RDP brute force attacks (failed logon attempts - Event ID 4625)
• Lateral movement via RDP (successful remote logons - Event ID 4624 with LogonType 10)
• Session hijacking indicators (reconnection patterns - Event IDs 4778, 25)
• Unauthorized remote access (RDP initiation from unexpected sources - Event ID 1149)
• Session persistence analysis (connect/disconnect patterns)
• Network logon correlation (LogonType 3 events)

Event Coverage:

Channel	Event IDs	Purpose
Security	4624, 4625, 4634, 4647, 4778, 4779	Authentication events (LogonType 3, 7, 10)
TerminalServices-LocalSessionManager	21, 22, 23, 24, 25, 39, 40	RDP session lifecycle
TerminalServices-RemoteConnectionManager	1149	RDP connection initiation
System	9009	Desktop Window Manager closure

Result

Query results include event timestamps, usernames, source IPs, logon types, and human-readable event descriptions (e.g., RDP_LOGON_SUCCESSFUL_NEW, SESSION_RECONNECTED, RDP_LOGON_FAILED) for rapid analyst triage.

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

rdp_authentication_windows_elastic

ECS Field Mappings

• event.category → ["authentication"] (static)
• event.action → osquery.rdp_authentication (static)
• event.code → eventid
• event.reason → event_description
• host.hostname → computer_name
• user.name → user_name
• user.domain → domain_name
• source.ip → source_ip
• source.port → source_port
• log.level → level
• process.pid → pid
• winlog.channel → channel
• winlog.logon.type → logon_type
• winlog.logon.id → logon_id
• winlog.event_data.WorkstationName → workstation_name
• winlog.event_data.LogonProcessName → logon_process
• winlog.event_data.AuthenticationPackageName → auth_package
• winlog.event_data.SubjectUserName → subject_user
• winlog.event_data.SubjectDomainName → subject_domain
• winlog.event_data.Status → status_code
• winlog.event_data.SubStatus → sub_status_code
• winlog.event_data.FailureReason → failure_reason
• tags → ["osquery", "rdp", "authentication", "lateral_movement", "windows"] (static)

SQL Query

-- Windows RDP Authentication and Session Events
-- Coverage: Security, System, and TerminalServices event logs
--
-- Security Channel Events:
--   4624 (LogonType 3,7,10): Successful logon
--   4625: Failed logon
--   4634: Logoff
--   4647: User-initiated logoff
--   4778: Session reconnect
--   4779: Session disconnect
--
-- TerminalServices-LocalSessionManager/Operational:
--   21: RDP Local Connected
--   22: RDP Remote Connected
--   23: RDP Session Logoff
--   24: RDP Local Disconnected
--   25: RDP Remote Reconnection
--   39: RDP Remote Disconnected (Formal)
--   40: RDP Remote Disconnected (Reason)
--
-- TerminalServices-RemoteConnectionManager/Operational:
--   1149: RDP Initiation Successful
--
-- System Channel:
--   9009: Desktop Window Manager Closed

-- Part 1: Security Channel - Authentication Events
SELECT
    datetime AS event_time,
    computer_name,
    'Security' AS channel,
    eventid,
    provider_name,
    level,
    json_extract(data, '$.EventData.TargetDomainName') AS domain_name,
    json_extract(data, '$.EventData.TargetUserName') AS user_name,
    json_extract(data, '$.EventData.LogonType') AS logon_type,
    json_extract(data, '$.EventData.IpAddress') AS source_ip,
    json_extract(data, '$.EventData.IpPort') AS source_port,
    json_extract(data, '$.EventData.WorkstationName') AS workstation_name,
    json_extract(data, '$.EventData.LogonProcessName') AS logon_process,
    json_extract(data, '$.EventData.AuthenticationPackageName') AS auth_package,
    json_extract(data, '$.EventData.TargetLogonId') AS logon_id,
    json_extract(data, '$.EventData.SubjectUserName') AS subject_user,
    json_extract(data, '$.EventData.SubjectDomainName') AS subject_domain,
    json_extract(data, '$.EventData.Status') AS status_code,
    json_extract(data, '$.EventData.SubStatus') AS sub_status_code,
    json_extract(data, '$.EventData.FailureReason') AS failure_reason,
    CASE
        WHEN eventid = 4624 AND json_extract(data, '$.EventData.LogonType') = '10' THEN 'RDP_LOGON_SUCCESSFUL_NEW'
        WHEN eventid = 4624 AND json_extract(data, '$.EventData.LogonType') = '3' THEN 'LOGON_SUCCESSFUL_NETWORK'
        WHEN eventid = 4624 AND json_extract(data, '$.EventData.LogonType') = '7' THEN 'LOGON_SUCCESSFUL_UNLOCK'
        WHEN eventid = 4625 AND json_extract(data, '$.EventData.LogonType') = '10' THEN 'RDP_LOGON_FAILED'
        WHEN eventid = 4625 AND json_extract(data, '$.EventData.LogonType') = '3' THEN 'LOGON_FAILED_NETWORK'
        WHEN eventid = 4634 THEN 'LOGOFF_DISCONNECT'
        WHEN eventid = 4647 THEN 'USER_INITIATED_LOGOFF'
        WHEN eventid = 4778 THEN 'SESSION_RECONNECTED'
        WHEN eventid = 4779 THEN 'SESSION_DISCONNECTED'
        ELSE 'UNKNOWN_' || eventid
    END AS event_description,
    pid,
    data
FROM windows_eventlog
WHERE
    channel = 'Security'
    AND (
        (eventid IN (4624, 4634) AND json_extract(data, '$.EventData.LogonType') IN ('3', '7', '10'))
        OR eventid IN (4778, 4625, 4779, 4647)
    )

UNION ALL

-- Part 2: TerminalServices-LocalSessionManager - RDP Session Events
SELECT
    datetime AS event_time,
    computer_name,
    'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' AS channel,
    eventid,
    provider_name,
    level,
    COALESCE(
        SUBSTR(json_extract(data, '$.UserData.EventXML.User'), 1, INSTR(json_extract(data, '$.UserData.EventXML.User'), '\\') - 1),
        json_extract(data, '$.UserData.EventXML.Param2')
    ) AS domain_name,
    COALESCE(
        SUBSTR(json_extract(data, '$.UserData.EventXML.User'), INSTR(json_extract(data, '$.UserData.EventXML.User'), '\\') + 1),
        json_extract(data, '$.UserData.EventXML.Param1')
    ) AS user_name,
    NULL AS logon_type,
    COALESCE(
        json_extract(data, '$.UserData.EventXML.Address'),
        json_extract(data, '$.UserData.EventXML.Param3')
    ) AS source_ip,
    NULL AS source_port,
    NULL AS workstation_name,
    NULL AS logon_process,
    NULL AS auth_package,
    json_extract(data, '$.UserData.EventXML.SessionID') AS logon_id,
    NULL AS subject_user,
    NULL AS subject_domain,
    NULL AS status_code,
    NULL AS sub_status_code,
    json_extract(data, '$.UserData.EventXML.Reason') AS failure_reason,
    CASE eventid
        WHEN 21 THEN 'RDP_LOCAL_CONNECTED'
        WHEN 22 THEN 'RDP_REMOTE_CONNECTED'
        WHEN 23 THEN 'RDP_SESSION_LOGOFF'
        WHEN 24 THEN 'RDP_LOCAL_DISCONNECTED'
        WHEN 25 THEN 'RDP_REMOTE_RECONNECTION'
        WHEN 39 THEN 'RDP_REMOTE_DISCONNECTED_FORMAL'
        WHEN 40 THEN 'RDP_REMOTE_DISCONNECTED_REASON'
        ELSE 'UNKNOWN_TSL_' || eventid
    END AS event_description,
    pid,
    data
FROM windows_eventlog
WHERE
    channel = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
    AND eventid IN (21, 22, 23, 24, 25, 39, 40)

UNION ALL

-- Part 3: TerminalServices-RemoteConnectionManager - RDP Initiation
SELECT
    datetime AS event_time,
    computer_name,
    'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' AS channel,
    eventid,
    provider_name,
    level,
    json_extract(data, '$.UserData.EventXML.Param2') AS domain_name,
    json_extract(data, '$.UserData.EventXML.Param1') AS user_name,
    NULL AS logon_type,
    json_extract(data, '$.UserData.EventXML.Param3') AS source_ip,
    NULL AS source_port,
    NULL AS workstation_name,
    NULL AS logon_process,
    NULL AS auth_package,
    NULL AS logon_id,
    NULL AS subject_user,
    NULL AS subject_domain,
    NULL AS status_code,
    NULL AS sub_status_code,
    NULL AS failure_reason,
    'RDP_INITIATION_SUCCESSFUL' AS event_description,
    pid,
    data
FROM windows_eventlog
WHERE
    channel = 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'
    AND eventid = 1149

UNION ALL

-- Part 4: System Channel - Desktop Window Manager Closed
SELECT
    datetime AS event_time,
    computer_name,
    'System' AS channel,
    eventid,
    provider_name,
    level,
    NULL AS domain_name,
    NULL AS user_name,
    NULL AS logon_type,
    NULL AS source_ip,
    NULL AS source_port,
    NULL AS workstation_name,
    NULL AS logon_process,
    NULL AS auth_package,
    NULL AS logon_id,
    NULL AS subject_user,
    NULL AS subject_domain,
    NULL AS status_code,
    NULL AS sub_status_code,
    NULL AS failure_reason,
    'DESKTOPWINDOWMANAGER_CLOSED' AS event_description,
    pid,
    data
FROM windows_eventlog
WHERE
    channel = 'System'
    AND eventid = 9009

ORDER BY event_time DESC;

---

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: bb1fc7c

Failed CI Steps

• :pipeline:⬆️ Upload Pipeline: .buildkite/pipeline.yml

History

• 💔 Build #36663 failed 4f378e9

[ferullo]

One minor thing

[ferullo]

remove