Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1027.map

Author: Eric Zimmerman saericzimmerman@gmail.com
Description: RDP Connected to domain
EventId: 1027
Channel: Microsoft-Windows-TerminalServices-RDPClient/Operational
Provider: Microsoft-Windows-TerminalServices-ClientActiveXCore
Maps: 
  - 
    Property: PayloadData1
    PropertyValue: "Domain: %DomainName%"
    Values: 
      - 
        Name: DomainName
        Value: "/Event/EventData/Data[@Name=\"DomainName\"]"
  - 
    Property: PayloadData6
    PropertyValue: "ActivityID: %ActivityID%"
    Values: 
      - 
        Name: ActivityID
        Value: "/Event/System/Correlation/@ActivityID" 

# Documentation:
# https://cyber-tls.blogspot.com/2019/08/rdp.html
# https://social.technet.microsoft.com/wiki/contents/articles/37847.rdp-direct-connection-with-nla-remote-desktop-client-event-logs.aspx
# https://nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/
#
# Example Event Data:
#Connected to domain (SERVER-01) with session 12.
#
#<Event>
#  <System>
#    <Provider Name="Microsoft-Windows-TerminalServices-ClientActiveXCore" Guid="28aa95bb-d444-4719-a36f-40462168127e" />
#    <EventID>1027</EventID>
#    <Version>0</Version>
#    <Level>4</Level>
#    <Task>101</Task>
#    <Opcode>10</Opcode>
#    <Keywords>0x4000000000000000</Keywords>
#    <TimeCreated SystemTime="2019-03-09 00:13:38.5088396" />
#    <EventRecordID>54</EventRecordID>
#    <Correlation ActivityID="f27cc7dc-446a-42d7-9a0f-cc3ab4f90000" />
#    <Execution ProcessID="16768" ThreadID="19860" />
#    <Channel>Microsoft-Windows-TerminalServices-RDPClient/Operational</Channel>
#    <Computer>EZ-W.Zim.local</Computer>
#    <Security UserID="S-1-5-21-238543598-4054144643-4261915534-1114" />
#  </System>
#  <EventData>
#    <Data Name="DomainName">ZIM</Data>
#    <Data Name="SessionId">1</Data>
#  </EventData>
#</Event>