Author: Eric Zimmerman saericzimmerman@gmail.com
Description: RDP reconnecting
EventId: 4778
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: UserName
    PropertyValue: "%domain%\\%user%"
    Values:
      -
        Name: domain
        Value: "/Event/EventData/Data[@Name=\"AccountDomain\"]"
      -
        Name: user
        Value: "/Event/EventData/Data[@Name=\"AccountName\"]"
  -
    Property: RemoteHost
    PropertyValue: "%ClientName% (%ClientAddress%)"
    Values:
      -
        Name: ClientAddress
        Value: "/Event/EventData/Data[@Name=\"ClientAddress\"]"
      -
        Name: ClientName
        Value: "/Event/EventData/Data[@Name=\"ClientName\"]"
  -
    Property: PayloadData1
    PropertyValue: "%SessionName%"
    Values:
      -
        Name: SessionName
        Value: "/Event/EventData/Data[@Name=\"SessionName\"]"
  -
    Property: PayloadData3
    PropertyValue: "LogonId: %LogonID%"
    Values:
      -
        Name: LogonID
        Value: "/Event/EventData/Data[@Name=\"LogonID\"]"

# Documentation:
# https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4778
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4778
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# Example Event Data:
# <Event>
#  <System>
#    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d" />
#    <EventID>4778</EventID>
#    <Version>0</Version>
#    <Level>0</Level>
#    <Task>12551</Task>
#    <Opcode>0</Opcode>
#    <Keywords>0x8020000000000000</Keywords>
#    <TimeCreated SystemTime="2018-07-17 19:03:44.9851573" />
#    <EventRecordID>25332</EventRecordID>
#    <Correlation ActivityID="3fd16c43-fc41-0001-ad6c-d13f41fcd301" />
#    <Execution ProcessID="744" ThreadID="2756" />
#    <Channel>Security</Channel>
#    <Computer>base-rd-01.shieldbase.lan</Computer>
#    <Security />
#  </System>
#  <EventData>
#    <Data Name="AccountName">tdungan</Data>
#    <Data Name="AccountDomain">shieldbase</Data>
#    <Data Name="LogonID">0x2A8EACE</Data>
#    <Data Name="SessionName">RDP-Tcp#5</Data>
#    <Data Name="ClientName">DUNGANATOR</Data>
#    <Data Name="ClientAddress">192.168.30.10</Data>
#  </EventData>
# </Event>
