DISSECTING RDP ACTIVITY

Summary from the TLDR InfoSec newsletter

Remote Desktop Protocol (RDP) is a common entry point for legitimate users and attackers in Windows environments. This blog post lists out event IDs and builds a timeline for an RDP session from logon to session end. It also includes a sample timeline of events for an RDP session.