This splunk query will return any failed attempts initiated by users to launch an RDP (remote desktop) session in a Windows environment. Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/ Windows Server 2008 and Newer: source=WinEventLog:Security sourcetype=WinEventLog:security Logon_Type=10 EventCode=4625 | eval Date=strftime(_time, “%Y/%m/%d”) | rex “Failed:\s+.*\s+Account\sName:\s+(?<TargetAccount>\S+)\s” | stats count by Date, TargetAccount, […]
