RDP Time Zone Bias

Lee Kirkpatrick of Sophos X-Ops' Incident Response team shows us a lesser-known but very useful event captured in the Windows Remote Desktop Services RDP Core TS Operational log. For more information and links to the resources mentioned in the series, please see the companion blog post: news.sophos.co...
00:00 Introduction
00:56 RDP timezone bias in modern Windows logging
01:29 What Event 104 reveals
02:15 An example
02:49 About false positives
03:00 Demonstrating the query
04:07 Wrapup