detection.wiki

Splashtop-Splashtop Business app-Remote Session › Event 31402

Event ID 31402 — The user SPID has ended the session recording during the Splashtop remote session (Session_ID).

Provider
Splashtop-Splashtop Business app-Remote Session
Channel
Operational

Description

The user SPID has ended the session recording during the Splashtop remote session (Session_ID).

Message #

The user %1 has ended the session recording during the Splashtop remote session (%2).

App version: %3

Recorded file name: %4

File path: %5

Error code: %6

Fields #

NameDescription
SPID UnicodeString—
Session_ID UnicodeString—
Version_number UnicodeString—
File_Name UnicodeString—
File_Path UnicodeString—
Error_code UnicodeString—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #