PowerShell RDP History Discovery

Bryant Smith@flowstate

•updated Apr 30, 2026•4•0•336

Detects PowerShell commands attempting to query the Terminal Services Remote Connection Manager event log for Event ID 1149. This may indicate adversary reconnaissance of RDP connection history to identify targets for lateral movement.