I noticed that my uplink bandwidth during a speed test seemed reduced, so I started investigating my network activity with Resource Monitor. I found that
svchost.exe was transmitting ~2kB/sec (~16kb/s) to
220.127.116.11, reportedly Illinois Century Network, a backbone provider in Springfield, IL.
With process explorer I discovered that this
svchost.exe PID was tied to an RDP session while I was logged in locally. I disabled remote desktop access and the process using the bandwidth immediately died. Of course my RDP port is open to the world, by design, so that I can access it away from home.
It appears clear to me that there were unauthorized attempts to access my PC remotely. How can I determine whether or not an RDP login attempt was successful?
I've checked in the TerminalServices-RemoteConnectionManager Operational logs and I can see what appears to be a smattering of common user names: "forms", "cecilia", "voicemail", "diane", etc. None of those accounts exist on my machine. Here's a sample entry:
Remote Desktop Services: User authentication succeeded: User: diane Domain: Source Network Address: 18.104.22.168
In the meantime, I've disabled remote desktop access. If I choose to restore it, I'll likely change the default port number at minimum. Anyone know how easy that would be to defeat via port scanning? A more secure method would be setting up SSH tunneling, though the Microsoft Android RDP client app doesn't support this.