detection.wiki

Splashtop-Splashtop Streamer-Remote Session › Event 1000

Event ID 1000 — A Splashtop remote session (Session_ID) has started to this computer by SPID from the device SRC_Name.

Provider
Splashtop-Splashtop Streamer-Remote Session
Channel
Operational

Description

A Splashtop remote session (Session_ID) has started to this computer by SPID from the device SRC_Name.

Message #

A Splashtop remote session (%1) has started to this computer by %2 from the device %3.

App version: %4

Fields #

NameDescription
Session_ID UnicodeString—
SPID UnicodeString—
SRC_Name UnicodeString—
Version_number UnicodeString—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #