DISSECTING RDP ACTIVITY

Summary from the TLDR InfoSec newsletter

This blog post examines RDP activity using Windows event logs for cybersecurity forensics. It identifies important event IDs for successful logins (1149 and 4624), failed attempts (4625), and session changes to detect brute-force attacks. The author demonstrates how correlating these events helps create timelines to reconstruct attacker behavior.