Detection rules › By eventMicrosoft-Windows-TerminalServices-RemoteConnectionManager event 11491 detection rule reference this event. View event page.Splunk (1)Windows RDP Connection Successful T1563.002