{"id":8780,"date":"2021-10-22T05:29:04","date_gmt":"2021-10-22T03:29:04","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8780"},"modified":"2022-09-09T17:23:22","modified_gmt":"2022-09-09T15:23:22","slug":"rdp-authentication-artifacts-for-dfir-purpose","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/dfir-and-incident-response\/rdp-authentication-artifacts-for-dfir-purpose\/","title":{"rendered":"RDP Authentication Artifacts for DFIR Purpose"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A good detection technique to spot Remote Desktop Connections that are exposed to the internet is to scan RDP event logs for any events where the source IP is a non-RFC 1918 address. This provides you a good way to check for locations that may be port forwarding RDP, like work from home users.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During a recent investigation involving Remote Desktop Connections, I discovered some behavior that limited this search functionality and was contrary to what I\u2019d observed in previous cases and seen documented in other blogs. so I created a Mind Map that represents different artifacts related to RDP authentication with NLA enabled or disabled to help collect and analyze forensic artifacts during DFIR engagements.<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/raw\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.pdf\">Download PDF<\/a><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/raw\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.xmind\">Download MindMap (xmind format)<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/raw\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.png\" alt=\"\" width=\"600\" height=\"800\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Successful Remote Interactive Logon<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#security\"><\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Security<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>EID 4624<\/strong><ul><li>An account was successfully logged on<ul><li>Logon Types<ul><li>10<ul><li>Successful User Account RemoteInteractive Logon<\/li><\/ul><\/li><li>12<ul><li>Successful User Account RemoteInteractive Logon Using Cached Credentials<\/li><\/ul><\/li><li>7<ul><li>Successful User Account RemoteInteractive Logon : Workstation was Unlocked<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 4776<\/strong><ul><li>The domain controller attempted to validate the credentials for an account<ul><li>Error Code<ul><li><em>0x0<\/em><ul><li>Successful Logon<\/li><\/ul><\/li><\/ul><\/li><li>This event occurs only on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative.<\/li><li>It shows successful and unsuccessful credential validation attempts.<\/li><li>Logon Account : the name of the account that had its credentials validated by the Authentication Package.<\/li><li>Source Workstation : The name of the computer from which the logon attempt originated.<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#terminalservices-remoteconnectionmanager\"><\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>TerminalServices-RemoteConnectionManager<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>EID 261<\/strong><ul><li>Listener X received a connection<ul><li>Service listening for inbound connection requests over the RDP Protocol<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 1149<\/strong><ul><li>Remote Desktop Services: User authentication succeeded<ul><li>An Event ID 1149 DOES NOT indicate successful authentication to a target, simply a successful RDP network connection<\/li><li>If you specify the RestrictedAdmin option, the username and domain will be blank.<\/li><li>If you turn off NLA and log on with Rdesktop, ID 1149 will not be recorded.<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 1158<\/strong><ul><li>Remote Desktop Services accepted a connection from IP address<ul><li>This will be available in the Administrative log records<\/li><li>Will also display the source IP<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#terminalservices-localsessionmanager\"><\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>TerminalServices-LocalSessionManager<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>EID 41<\/strong><ul><li>Begin session arbitration<ul><li>Provides the session ID for potential correlations with other events<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 42<\/strong><ul><li>End session arbitration<ul><li>Provides the session ID for potential correlations with other events<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 21<\/strong><ul><li>Remote Desktop Services: Session logon succeeded<ul><li>If the source network address is not LOCAL the IP is the source of the remote authentication<\/li><li>Also provides the session ID<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 22<\/strong><ul><li>Remote Desktop Services: Shell start notification received<ul><li>If the source network address is not LOCAL the IP is the source of the Remote authentication<\/li><li>Also provides the session ID<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 25<\/strong><ul><li>Remote Desktop Services: Session reconnection succeeded<ul><li>Also provides the session ID<\/li><li>Also provides the source IP<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 24<\/strong><ul><li>Remote Desktop Services: Session has been disconnecte<ul><li>Also provides the session ID<\/li><li>Also provides the source IP<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#remotedesktopservices-rdpcorets\"><\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>RemoteDesktopServices-RdpCoreTS<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>EID 131<\/strong><ul><li>The server accepted a new TCP connection from client SOURCE IP:PORT.<\/li><\/ul><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#unsuccessful-remote-interactive-logon\"><\/a><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Unsuccessful Remote Interactive Logon<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#nla-enabled\"><\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>NLA Enabled<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Security<\/strong><ul><li><strong>NTLM<\/strong><ul><li><strong>EID 4776<\/strong><ul><li>The domain controller attempted to validate the credentials for an account<ul><li>Suspicious Error Codes<ul><li><em>0xC0000064<\/em><ul><li>User name does not exist<\/li><\/ul><\/li><li><em>0xC0000070<\/em><ul><li>User logon from unauthorized workstation<\/li><\/ul><\/li><li><em>0xC0000072<\/em><ul><li>User logon to account disabled by administrator<\/li><\/ul><\/li><li><em>0xC000006F<\/em><ul><li>User logon outside authorized hours<\/li><\/ul><\/li><li><em>0xC0000413<\/em><ul><li>Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine<\/li><\/ul><\/li><li><em>0xC000018C<\/em><ul><li>The logon request failed because the trust relationship between the primary domain and the trusted domain failed<\/li><\/ul><\/li><li><em>0xC000015B<\/em><ul><li>The user has not been granted the requested logon type (aka logon right) at this machine<\/li><\/ul><\/li><\/ul><\/li><li>This event occurs only on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative.<\/li><li>It shows successful and unsuccessful credential validation attempts.<\/li><li>Logon Account : the name of the account that had its credentials validated by the Authentication Package.<\/li><li>Source Workstation : The name of the computer from which the logon attempt originated.<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li><strong>Kerberos<\/strong><ul><li><strong>EID 4771<\/strong><ul><li>Kerberos pre-authentication failed<ul><li>Account Name = Source host<\/li><li>Client Address = Source IP.<\/li><li>Common Failure Codes<ul><li>0x6<ul><li>Bad user name, or new computer\/user account has not replicated to DC yet<\/li><\/ul><\/li><li>0x7<ul><li>New computer account has not replicated yet or computer is pre-w2k<\/li><\/ul><\/li><li>0x9<ul><li>administrator should reset the password on the account<\/li><\/ul><\/li><li>0xC<ul><li>Workstation restriction<\/li><\/ul><\/li><li>0x12<ul><li>Account disabled, expired, locked out, logon hours.<\/li><\/ul><\/li><li>0x17<ul><li>The user\u2019s password has expired.<\/li><\/ul><\/li><li>0x18<ul><li>Usually means bad password<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li><strong>TerminalServices-RemoteConnectionManager<\/strong><ul><li><strong>EID 1149<\/strong><ul><li>Remote Desktop Services: User authentication succeeded<ul><li>An Event ID 1149 DOES NOT indicate successful authentication to a target, simply a successful RDP network connection<\/li><li>if username and domain are blank that can be due to the specification of RestrictedAdmin option<\/li><li>If you turn off NLA and log on with Rdesktop, ID 1149 will not be recorded.<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 261<\/strong><ul><li>Listener X received a connection<ul><li>Service listening for inbound connection requests over the RDP Protocol<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li><strong>RemoteDesktopServices-RdpCoreTS<\/strong><ul><li><strong>EID 140<\/strong><ul><li>A connection from the client computer with an IP address of SOURCE IP failed because the user name or password is not correct.<\/li><li>Despite the event description it will only be recorded when the user name DOES NOT EXIST<\/li><li>For a username that exists use a correlation between EID 4625 &amp; EID 131<\/li><\/ul><\/li><li><strong>EID 131<\/strong><ul><li>The server accepted a new TCP connection from client SOURCE IP:PORT.<\/li><li>Records the source IP of every RDP authentication attempt<\/li><li>To be correlated with EID 4625 in order to identify the source IP (depending on the OS version)<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#nla-disabled\"><\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>NLA Disabled<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Security<\/strong><ul><li><strong>EID 4625<\/strong><ul><li>An account failed to log on<ul><li>Logon Type = 10<\/li><li>Client Address = Source IP (depending on the OS version)<\/li><li>Account Name<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li><strong>RemoteDesktopServices-RdpCoreTS<\/strong><ul><li><strong>EID 140<\/strong><ul><li>A connection from the client computer with an IP address of SOURCE IP failed because the user name or password is not correct.<\/li><li>Despite the event description it will only be recorded when the user name DOES NOT EXIST<\/li><li>For a username that exists use a correlation between EID 4625 &amp; EID 131<\/li><\/ul><\/li><li><strong>EID 131<\/strong><ul><li>The server accepted a new TCP connection from client SOURCE IP:PORT.<\/li><li>Records the source IP of every RDP authentication attempt<\/li><li>To be correlated with EID 4625 in order to identify the source IP (depending on the OS version)<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#others\"><\/a><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">Others<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/mahyarx\/MindMaps4DFIR\/blob\/main\/OSArtifacts\/Windows\/RDP_Authentication_Artifacts\/RDP_DFIR.md#security-1\"><\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Security<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>EID 4778<\/strong><ul><li>A session was reconnected to a Window Station<ul><li>Account Name<\/li><li>Source IP<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 4779<\/strong><ul><li>A session was disconnected from a Window Station<ul><li>Account Name<\/li><li>Source IP<\/li><\/ul><\/li><\/ul><\/li><li><strong>EID 4688<\/strong><ul><li>Process Creation<ul><li>rdpclip.exe<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A good detection technique to spot Remote Desktop Connections that are exposed to the internet is to scan RDP event logs for any events where the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8781,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[224,229,235],"tags":[179,246,259,180,275,176],"class_list":["post-8780","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dfir-and-incident-response","category-network-and-protocol-security","category-windows-and-server","tag-dfir","tag-digital-forensics","tag-network-security","tag-rdp","tag-threat-detection","tag-windows"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8780","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8780"}],"version-history":[{"count":4,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8780\/revisions"}],"predecessor-version":[{"id":8997,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8780\/revisions\/8997"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8781"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}