detection.wiki

Splashtop-Splashtop Business app-Remote Session › Event 31000

Event ID 31000 — A Splashtop remote session (Session_ID) has started from this computer by the user SPID to the device SRS_Name.

Provider
Splashtop-Splashtop Business app-Remote Session
Channel
Operational

Description

A Splashtop remote session (Session_ID) has started from this computer by the user SPID to the device SRS_Name.

Message #

A Splashtop remote session (%1) has started from this computer by the user %2 to the device %3.

App version: %4

Fields #

NameDescription
Session_ID UnicodeString—
SPID UnicodeString—
SRS_Name UnicodeString—
Version_number UnicodeString—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #