SYSMON Event ID 3 - RDP logon issue : "Initiated" field allways false

Jérémy Beaugeard 1

Hello,

I have an issue with Sysmon event ID 3. This event is related to network connections. When i logon to my windows client via RDP, sysmon shows this log event :

As you can see the "Initiated" field is set to false. There is no difference between this event and the RDP connection failure. Should the "Initiated" field not be set to true in this case ?

Note : I use my AD credentials to log myself.

Thanks,

Jeremy

dstaulcu 351 Reputation points

2021-08-26T01:12:35.893+00:00

Sysmon is simply reporting that a network connection relating to a port (associated with RDP) was established and initiated locally. If the network connection had been initiated remotely initiated would have been false. Sysmon does not get into the details of whether a full RDP session was successful and therefore initiated should not be influenced in that way.

Try initiating test-connection to the the same port via powershell from a remote computer. Does initiated value flip in that case?
Jérémy Beaugeard 1 Reputation point

2021-08-26T07:48:40.99+00:00

Thanks for the precise answer.
So there is no way of using Sysmon alone to monitor those windows logs.
dstaulcu 351 Reputation points

2021-08-29T14:38:54.757+00:00

Can you be more specific about what you want to monitor? Is it failed/successful RDP logon attempts?
There are a whole bunch of windows event log types which relate to remote connections. Maybe some of those have what you need.
I made the following powershell script a while back to simplify discovery of potential logs to collect. Maybe that would be helpful for you.
Here's a gif demonstrating how it works.