Lion Cipher Lab

Prove outbound RDP from the source machine's artifacts (the other half of lateral movement)

• Digital Forensics & IR (DFIR)
• Intermediate
• ~60 min
• Free · no account required

Why it matters

When an intruder moves from machine to machine with Remote Desktop, investigators usually start at the far end: the server's Security log shows a type-10 logon from some IP address. That tells you a hop landed, but not much about where it came from or what else that source machine reached. The machine the attacker typed into keeps its own record: the RDP client writes every server name it tries into its own event log, Windows remembers recent destinations and the account used for each in the registry, and the client program leaves execution evidence. Reading both ends is how you rebuild a…

What you'll learn

• Naming the artifacts Remote Desktop Connection (mstsc.exe) leaves on the machine you connect FROM: the TerminalServices-RDPClient/Operational log, the Terminal Server Client Default MRU and Servers\<host> UsernameHint registry values, Prefetch and Default.rdp
• Reading the RDPClient channel's event definitions straight from the Windows provider manifest with Get-WinEvent -ListProvider, instead of trusting a blog's list
• Grouping client events into one connection attempt by ActivityId, and telling an attempt that connected (1024 then 1025) from one that never did (1024 with no 1025)
• Testing a Base64(SHA256(UserName)) value against candidate account names without knowing the encoding in advance
• Joining source-side client records to target-side 4624 LogonType 10 events to build source -> target hops, and measuring what each side alone misses
• Spotting cleared RDP history (an empty MRU next to a busy client log) and a non-network 'server' (a GUID) before they corrupt the hop list

Steps in this lab

1. Every RDP hop has two ends - and the source end is the one people forget
2. Read the client log's definitions from Windows itself
3. The registry remembers where you went, and as whom
4. Build the evidence: three source machines, three servers
5. Turn a 1029 hash back into a candidate user name
6. Correlate the two ends into hops
7. Read the hops like an investigator
8. Corroborate with the registry - and catch the cleared history
9. The honest limits
10. When to reach for this, and how a pro does it better

Open the full interactive lab →