Event Logs Queried for RDP Sessions [splunk-winevent]

Threat actors may query Windows Terminal Services logs for RDP session information. - Example 1: During post-compromise reconnaissance activities, Lazarus was observed using wevtutil to query Windows Terminal Services logs for RDP sessions (Event Code 25) in order to gather session reconnection information. - Example 2: Threat actor tracked as Cluster Charlie (STAC1305) searched Windows Event Logs for Windows Remote Connection Manager event ID 1149 -- This use case detects commands querying Terminal Services logs for event 25 for user disconnection or event 1149 for records of successful Remote Desktop Services (RDP) logon attempt. While threat actors will most likely be using wevtutil to perform the queries, it has been omitted from the logic to account for instances where it has been renamed. -- Threat Actor Association: Cluster Charlie (STAC1305), Lazarus