Skip to content
Sign In
Telemetry

win:terminalservices

Remote Desktop logs

Channels: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational, -LocalSessionManager/Operational, RDPClient

Host type
Windows (workstation, member server, domain controller)
Techniques
0
Rules listed
3
Events
4

Standards and guidance naming this source

RequirementRelationBasis
OMB M-26-14: Attack vectors and lateral movementSupports an activityour analysis: RDP sessions

Techniques

No ATT&CK analytic names this source.

Rules

Splunk 2
Sigma 1

Events

Recommended (1)

  • 1024Outbound TS Connect Attempt

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.