Add RDP logon/logoff information to `timeline-logon` command

[YamatoSecurity]

Add RDP logon/logoff information to timeline-logon command. There are also RDP reconnect logs that contain source IP address info that should be added. Will have to think about how best to correlate the multiple logs into single events though..

[fukusuket]

RDS-Gateway

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc775267(v=ws.10)
• https://woshub.com/rdp-connection-logs-forensics-windows/

[fukusuket]

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
• https://github.com/Yamato-Security/hayabusa-rules/blob/main/hayabusa/builtin/TerminalServices-LocalSessionManager_Op/LocalSessManager_21_Info_RDS-SessLogon.yml
• https://github.com/Yamato-Security/hayabusa-rules/blob/main/hayabusa/builtin/TerminalServices-LocalSessionManager_Op/LocalSessManager_25_Info_RDS-SessReconn.yml
• https://github.com/Yamato-Security/hayabusa-rules/blob/main/hayabusa/builtin/TerminalServices-Gateway_Op/RDS_Gateway_302_Info_LogonSuccess.yml

[fukusuket]

@YamatoSecurity I have a question! IMHO, It would be useful to simply have the output in timestamp order without tying it to a single event. What do you think?🤔

[YamatoSecurity]

@fukusuket I think that it depends on the analyst and situation. I think by default we should put things in single events to minimize the events to make things easier to read (I don't think we can add reconnect logs here though) but I was thinking about adding an option to display each event as single events. Since we were only looking at a handful of Security events, I figured that people could just easily filter on those event IDs in Timeline explorer, etc.. to get the singe event logon timeline but if we are adding information and RDP logs, then we might want to have an option to extract out those logon events and put in a timeline but not consolidate them into single events. What do you think?

[fukusuket]

@YamatoSecurity Thank you for comment! I see... as you said, it depends on the situation. It would be best if it could be selected as an option!

Let me confirm one thing! What kind of image did you have in mind for put single events? In my image, I thought it meant consolidating the information of Sec 4624/RDS 21 into one event. If that's the case, it seems there is no way to consolidate them into a single event...🤔 Am I misunderstanding...?

[YamatoSecurity]

I was thinking consolidating 4624 logon events with logoff events like we do now, and consolidating RDP logon and logoff events in one event (and calculate the logon time based on that). I haven't thought about consolidating RDP events and Sec 4624 events together. I would have to look into that so for now, I think we should separate Security events and RDP log events. There may be source IP address info. etc.. inside RDP reconnect logs so I would like to use that information inside the consolidated RDP event if it is not already there.

[fukusuket]

I understood! I forgot that the Security logoff events for 4634 were consolidated😅 Yes, it's better to separate Security and RDP log!