detection.wiki

Splashtop-Splashtop Streamer-Remote Session › Event 1700

Event ID 1700 — The user SPID enabled Device Redirection during the Splashtop remote session (Session_ID).

Provider
Splashtop-Splashtop Streamer-Remote Session
Channel
Operational

Description

The user SPID enabled Device Redirection during the Splashtop remote session (Session_ID).

Message #

The user %1 enabled Device Redirection during the Splashtop remote session (%2).

App version: %3

Source: %4



Device info

Product name: %5 (%6)

Manufacturer: %7 (%8)

Serial number: %9

VendorID: %10

ProductID: %11

Class type: %12 (%13)

Sub-class type: %14 (%15)

Protocol: %16 (%17)

Device version: %18

Usb version: %19

Fields #

NameDescription
SPID UnicodeString—
Session_ID UnicodeString—
Version_number UnicodeString—
Reason UnicodeString—
Product_Name UnicodeString—
Mounted_Product_Name UnicodeString—
Manufacturer UnicodeString—
Mounted_Manufacturer UnicodeString—
Serial_Numver UnicodeString—
Vendor_ID UnicodeString—
Product_ID UnicodeString—
Class_Type UnicodeString—
Mounted_Class_Type UnicodeString—
SubClass_Type UnicodeString—
Mounted_SubClass_Type UnicodeString—
Protocol UnicodeString—
Known values
0
HOPOPT
1
ICMP
2
IGMP
6
TCP
17
UDP
41
IPv6
43
IPv6-Route
44
IPv6-Frag
47
GRE
50
ESP
51
AH
58
ICMPv6
89
OSPF
103
PIM
132
SCTP
Mounted_Protocol UnicodeString—
Device_Version UnicodeString—
USB_Version UnicodeString—

Community Notes #

Legitimate RATs: a comprehensive forensic analysis of the usual suspects

References #