How many RDP connections were made?

Career Paths SOC Analyst
1

Hello Pro’s,

I was working on SOC Analyst course virtual lab “[Local Authentication in Windows]” question 3 “How many RDP connections were made?”. I used all possible queries related to RDP eventId and LogonType but whatever I add as a response, it appears incorrect. Please refer screenshot for more details.

Can someone help with query or response for the question?

Thanks,

image
image1366×764 193 KB

2

What is the logon type for interactive remote connections like RDP ?

image
image529×788 95.5 KB

3

Hello Joseph

Thank you for your help.

I have tried for logonType = 3 whose count is 35, for logonType = 10 - RDP count in the results is 13 and for logonType = 11 - RDP count in the results is (no match) and for combined logonType one of 3 , 10 - RDP count in the result is 48.
Like I shared earlier all answers are treated as incorrect. I have checked above documentation as well where windows 10 uses LogonType = 10 but it is not working.

Thanks,
Bhavesh R Bhanushali

4

image
image1258×407 73.2 KB

Note I am looking for logon events (connections) and RDP. This gives me the correct answer.

If you only look for Logon Type 10 you will get both connections and disconnects.

I don’t want this to be an unfair question, do you think asking for “RDP logons” would make the answer more clear?

5

Hello Joseph,

Thank you for your help and clarity.

I was using correct query but timestamp considered was 24 hours due to which I was getting incorrect results.

Thanks again!!

1 Like