Lion Cipher Lab

Reconstruct Remote Desktop (RDP) sessions from Windows event logs

• Digital Forensics & IR (DFIR)
• Intermediate
• ~50 min
• Free · no account required

Why it matters

Remote Desktop is how administrators run Windows servers, and it is also one of the most common ways intruders move once they hold a password: MITRE ATT&CK tracks it as T1021.001, Remote Services: Remote Desktop Protocol, and ransomware incident reports routinely include a line like 'the actor connected over RDP from host X at 02:14'. Somebody had to rebuild that line from logs, and the first thing a responder is asked is 'who was on this server, from where, and for how long?' The trap is that no single Windows log answers it. The Security log records logons but treats a reconnect like a new…

What you'll learn

• naming the three Windows log channels that each see a different slice of one Remote Desktop session -- Security, TerminalServices-RemoteConnectionManager/Operational, and TerminalServices-LocalSessionManager/Operational -- and which event IDs each contributes (4624, 4778, 4779, 4634, 4647; 1149; 21, 22, 23, 24, 25)
• reading 4624 logon types the way RDP actually uses them: 10 (RemoteInteractive) for a fresh desktop, 7 (Unlock) for some reconnects, and 3 (Network) for the Network Level Authentication handshake that precedes a type 10
• measuring why 'count 4624 type 10' is wrong even when its number looks right: on the lab data it says 5 sessions and 8h13m41s, but it double-counts one reconnect, misses a whole session, and inflates connected time by more than 3.5 hours
• writing a Python-standard-library reconstructor (json, datetime) that uses the LocalSessionManager Session ID as the backbone, binds Security Logon IDs to it, and reports per-session connected time vs wall-clock time
• treating RCM 1149 as 'network authentication succeeded', NOT proof of a logon -- one of the 8 in the lab never became a session
• spotting the cases correlation cannot fix: LOCAL/127.0.0.1 sources behind a tunnel or gateway, a Security channel that goes silent (event 1100), and sessions that began before the log window
• optionally reading the real LocalSessionManager channel on your own Windows PC with PowerShell Get-WinEvent

Steps in this lab

1. What an RDP session is, and the three logs that each see part of it
2. How this lab differs from its neighbours
3. Create the evidence: one server's day as JSON lines
4. Write the reconstructor (and the naive shortcut, for comparison)
5. Measure the BEFORE: count 4624 type 10
6. Measure the AFTER: correlate all three channels
7. The honest negatives: what correlation still cannot tell you
8. Optional: look at the real LocalSessionManager channel on your own PC
9. When to use this, and how a pro does it better

Open the full interactive lab →